PLEASE PLEASE PLEASE HELP! Win32:Ircbot-WS [TRJ]

Viruses and worms
1

Hello,

I started MIRC 6.17 today, and received a warning from AVAST (definition file 0613-0 - 28/03/06) that two files servers.ini and mirc3.tm_ in the c:\program Files\mirc directory were infected with Win32:Ircbot-ws.

I have never downloaded any files from IRC, run any scripts or done ANYTHING apart from chat.

I read a previous post similar to this one on the AVAST forum.

Is this a real virus?

A full system scan found 29 other infected files in c:\system volume information_restore named A0005327.ini to A0006999.ini

When I searched the avast website, I was unable to find any specific information about the Win32:Ircbot-ws virus.

I moved all infected files mentioned above to the virus chest.

Another full system scan afterwards turned up nothing - ie. no more infected files.

PLEASE PLEASE PLEASE HELP WITH THE FOLLOWING QUESTIONS:

  • Can you please provide specific information on this virus? (eg. what it does, etc.)
  • I moved all infected files mentioned above to the virus chest, should I delete them?
  • Is it ok to delete the files from system volume information_restore directory? what are these files?
  • Do I need to do anything else? Is the system registry infected or anything else?

Please help, I would be forever grateful for ANY assistance! I am panicing.

Thanks so much for your time,

Peter.

2

Hello Peter :slight_smile:

I think that this topic is similar like yours :wink: → http://forum.avast.com/index.php?topic=20181.0
Most probably False positive :stuck_out_tongue:

3

Hello XMAS,

Thanks very much for your reply, it is really much appreciated.

Yes, that is the one I read, but I am still unsure what to do as I am new to computers and don’t know what false positive is or what the system restore folder is. . . . .

PLEASE, PLEASE, PLEASE could someone please help me with the following questions?

  • Can you please provide specific information on this virus? (eg. what it does, etc.)
  • I moved all infected files mentioned above to the virus chest, should I delete them?
  • Is it ok to delete the files from system volume information_restore directory? what are these files?
  • Do I need to do anything else? Is the system registry infected or anything else?

Thank you so much, words can’t express how much I would appreciate your guidance.

MANY THANKS,

Peter

4

Hello XMAS,

Thanks very much for your reply, it is really much appreciated.

Yes, that is the one I read, but I am still unsure what to do as I am new to computers and don’t know what false positive is or what the system restore folder is. . . . .

PLEASE, PLEASE, PLEASE could someone please help me with the following questions?

  • Can you please provide specific information on this virus? (eg. what it does, etc.)
  • I moved all infected files mentioned above to the virus chest, should I delete them?
  • Is it ok to delete the files from system volume information_restore directory? what are these files?
  • Do I need to do anything else? Is the system registry infected or anything else?

Thank you so much, words can’t express how much I would appreciate your guidance.

MANY THANKS,

Peter

5

Well I can’t provide you information about the virus, but since it may be a false Positive you won’t have to worry about it - False Positive (FP) means that the scanner is giving you a wrong alarm (false alarm) the file is not dangerous (but this is ONLY WHEN THE FILE IS FALSE POSITIVE) Here’s some info how to deal with False positives : http://forum.avast.com/index.php?topic=7779.0 :wink:

6

System Restore is something like a backup of your whole system. System Restore creates restore points from where you can restore your system in cases when your system is heavy damaged. So these files are just backups of the original files. Maybe you can find some more info on Microsoft web page (I can’t find the link right now)

7

:slight_smile: Hi Peter :

 Since you are new to computers, a good start to an
"education" in this area would be the info at :
 http://aumha.org/a/health.htm .

 If you ever have technical questions about your computer,
 the aumha.net forums has many Microsoft Most Valuable
 Professionals and all their answers are FREE .
8

This just happened to me as well, im know my way around mirc so was pretty shocked for a few seconds.

trying to download the most recent servers.ini from the mirc site

http://www.mirc.co.uk/servers.ini

will trigger the virus warning again, so something is up, dunno what MIRC3.tm_ is tho, how can i get it out of the chest to have a look and see what it is?

9

Also see this avast thread, it could well be related as this also relates to MIRC 6.17 http://forum.avast.com/index.php?topic=20181.0. So it may well be a false positive but best to confirm at Jotti, and sent to avast if an FP.

10

Pls keep us inform what to do I would apprecate that. I deleted my my server.ini and now I can’t use mirc and don’t know what to do. Thanks

11

Is there something else needs to be done in order to make the server.ini files be ignored by standard shield? Simply adding the path\filename to the advanced\exclusions box does not not keep the scanner from alerting each time I connect to a server using mirc.

I did notice the sensitivity slider will not stay set on Custom, keeps returning to High. Is there a reason for this?

don

12

I strongly suggest running a full system scan on your PC with AVAST as I found a further 29 infected files in the system volume information directory.

This may NOT be a false positive if there are 29 other infected files.

Could someone from AVAST please respond?

Thanks,

Peter

13

It will work without the server.ini, just type in to the status window entry box

“/server ”

You can look up server addresses here http://irc.netsplit.de/networks/listings.var , or at your servers webpage

Webchat would be “/server irc.webchat.org” for example

14

The False Positive is fixed in the latest VPS 0613-1 :wink:

15

awesome, cheers

16

Thank you for the advice and guidance, it is much appreciated.

Wish you all the very best for the future.

17

I just found out to if you go to www.mirc.com you can download the new server.ini for February 8th and there is no virus or torijons either.

18

I think that is more likely because the False Positive has been corrected as X.M.A.S. mentioned here http://forum.avast.com/index.php?topic=20182.msg169253#msg169253