PLEASE PLEASE PLEASE HELP! Win32:Ircbot-ws [trj]

Avast Free Antivirus / Premium Security
1

Hello,

I started MIRC 6.17 today, and received a warning from AVAST (definition file 0613-0 - 28/03/06) that two files servers.ini and mirc3.tm_ in the c:\program Files\mirc directory were infected with Win32:Ircbot-ws.

I have never downloaded any files from IRC, run any scripts or done ANYTHING apart from chat.

I read a previous post similar to this one on the AVAST forum.

Is this a real virus?

A full system scan found 29 other infected files in c:\system volume information_restore named A0005327.ini to A0006999.ini

When I searched the avast website, I was unable to find any specific information about the Win32:Ircbot-ws virus.

I moved all infected files mentioned above to the virus chest.

Another full system scan afterwards turned up nothing - ie. no more infected files.

PLEASE PLEASE PLEASE HELP WITH THE FOLLOWING QUESTIONS:

  • Can you please provide specific information on this virus? (eg. what it does, etc.)
  • I moved all infected files mentioned above to the virus chest, should I delete them?
  • Is it ok to delete the files from system volume information_restore directory? what are these files?
  • Do I need to do anything else? Is the system registry infected or anything else?

Please help, I would be forever grateful for ANY assistance! I am panicing.

Thanks so much for your time,

Peter.

2

Duplicate post - being dealt with at http://forum.avast.com/index.php?topic=20182.0

3

Hi I got the same thing this morning and I deleted all my severs.ini and don’t know what to do too. Please keep us inform in what to do. Thanks

4

I would suggest putting this in the active thread and watch it. Deletion is never a best first option, move to the chest and investigate.