[thelist] mIRC

[Aredridel]

On Thu, 2003-07-03 at 14:40, Debbe Watson wrote:
> This mystery ( mystery meaning I did download it and don't know how I
> ended up with it) program is causing caos on my system.  I am about to
> uninstall it. Question is... what will it drag off the system with it?
> Any ideas?

I had the same happen to me a few days ago -- something malicious using
mIRC to actually run the script. It appears that both the script or
extension DLL and mIRC were added by the attack, not a hole in my
installed copy.

The nasties resided in c:\WINNT\System32 -- look in there, mine was
explorer.exe and explorer.dll.  You can recognize them as their file
properties has no version info tab.

Ari

> 
> debbe
>