BKDR_IRCFLOOD.X >>>>>NEED HELP

Help with EFnet related issues

Moderators: Website/Forum Admins, EFnet/Help Moderators

menopausi
Posts: 4
Joined: Mon Apr 19, 2004 7:46 pm
Location: USA

BKDR_IRCFLOOD.X >>>>>NEED HELP

Postby menopausi » Mon Apr 19, 2004 9:18 pm

:? Every time I log onto mIRC, I get the virus in the subject line. It never fails. There was a guy got mad at me because I didn't react to his flirting except to ask him nicely to stop, then told him. I asked an op to see if he could do something, so he watched him and banned him. Now, I get a virus every time I log on. I was told by an op that he and his 'girlfriend' have 'hacking abilities'. I don't have a problem with it unless I log onto IRC and it didn't start until all that happened. In 27 days it was cleaned from my machine 45 times. A few days it was cleaned 3 and 4 times. Nobody else has had a problem with it. It seems its just me. I tried going from EFnet to DALnet to see if it did it there, and it did. Just not as many times as in EFnet. I guess what I'm asking, in a round about way, are there ways to target one individual with a virus and is there any way to find out who/where/how its coming from. I was told that the 'girlfriend' did, in fact, send a virus to another woman and has threatened to 'melt down' others' pc's. I'm just getting tired of it. If I don't get on mIRC, I don't get it. But I love mIRC and don't like the idea of not 'seeing' my friends and having fun. Any ideas? Anything would be greatly appreciated. Pardon the typos. I'm new at this and I'm still learning to operate my computer. There's GOT to be a way to find out where it's coming from. Thanks for ANY help. menopausin :D
I don't suffer from insanity, I love every minute of it!
User avatar
0versight
Posts: 33
Joined: Sat Jan 17, 2004 2:52 am
Location: Cen Cal

Postby 0versight » Mon Apr 19, 2004 10:16 pm

You need to upgrade to the latest mIRC version.....if this is a new virus and you are running the latest mIRC version then I suggest trying another IRC client like, Xchat, Klient, or HydraIRC. If you want to find and download these other clients......google is your friend.
IRC is how I deal with reality.
menopausi
Posts: 4
Joined: Mon Apr 19, 2004 7:46 pm
Location: USA

Postby menopausi » Mon Apr 19, 2004 10:28 pm

:D Thanks! I'll do that right now. I'm kinda new ti mIRC and didn't know there was any others. Thanks again! menopausin
I don't suffer from insanity, I love every minute of it!
User avatar
munky
Site Admin
Posts: 826
Joined: Wed Jul 02, 2003 4:54 pm
Location: Phoenix AZ
Contact:

Postby munky » Tue Apr 20, 2004 12:50 am

completely uninstall (uninstall, and delete any remaning directories) for mIRC, and reinstall the newest version.
anti-virus software is always a good idea
if you run windows xp, it may also be a good idea to turn on ICF
http://support.microsoft.com/default.as ... us;q320855

also, check out this:
http://www.trendmicro.com/vinfo/virusen ... IRCFLOOD.x
In God we trust,
Everyone else must have an X.509 certificate.
menopausi
Posts: 4
Joined: Mon Apr 19, 2004 7:46 pm
Location: USA

Postby menopausi » Tue Apr 20, 2004 2:21 am

Trend Micro is the anti-virus installed on my computer. I followed your links and followed Trend's instructions to go to the registry and delete the entries there that the virus would leave. There weren't any. Trend has cleaned it every time it tried to infect it. Trend runs a complete check every morning at 8:00. I have the newest version of mIRC. I un and reinstalled about 2 weeks before this started. I had a problem getting logged on to irc when I first started. A friend talked with an op and he asked if I had my firewall on. I did. When I turned it off, I could log on with no problem. My computer started acting up and mIRC did too, so I did some troubleshooting and did some un and reinstalling of a few programs. mIRC was one of them. I had Trend on my computer at the time. About 2 weeks later, a week after this guy got mad at me, this trojan/virus starts showing up on my computer. It hasn't infected my computer yet, thank God and trend, but I'm going to try the firewall again and see what happens. I couldn't get it to work with it before, but I haven't tried it since I reinstalled it. Thanks! I feel better knowing its not in my registry, and that Trend is on top of things. I tried downloading the HydraIRC and got a window that said it was a corrupted copy being downloaded, so I stopped it. If I uninstall mIRC again, how do I make sur all traces of it are gone? I have the Registry Mechanic I can run. If I go into the registry much, it really will be messed up! LOL I can follow directions, but going in and trying to find it myself.....Any way to find out where its coming from? Thanks! menopausin
I don't suffer from insanity, I love every minute of it!
User avatar
0versight
Posts: 33
Joined: Sat Jan 17, 2004 2:52 am
Location: Cen Cal

Postby 0versight » Tue Apr 20, 2004 10:17 am

Reinstall mIRC so it overwrites everything......then uninstall it......Reboot.

Now go to C:\Program Files\

and Delete the mIRC folder

Now install mIRC once again and see if it works.

If this doesnt work then try Xchat
IRC is how I deal with reality.
User avatar
munky
Site Admin
Posts: 826
Joined: Wed Jul 02, 2003 4:54 pm
Location: Phoenix AZ
Contact:

Postby munky » Tue Apr 20, 2004 2:40 pm

if you couldn't get on irc with the firewall on, it was probably because you were trying to use a server that requires ident. i don't know the specifics of ICF, but it should have no problems allowing outbound connections. if one server fails with the firewall on, try another server (http://www.efnet.info/?module=servers, irc.ca.efnet.info, irc.us.efnet.info, or irc.eu.efnet.info)
In God we trust,
Everyone else must have an X.509 certificate.
prefect
Posts: 76
Joined: Mon Jul 14, 2003 6:25 pm
Location: Oslo

Postby prefect » Wed Apr 21, 2004 12:29 pm

you're infected even tho it only spreads while you're on irc using mIRC. it can be more evilness lurking around in your system.

i suggest scanning with The Cleaner, follow all instructions at http://hackfix.org/software/configure/cleaner.html
menopausi
Posts: 4
Joined: Mon Apr 19, 2004 7:46 pm
Location: USA

Postby menopausi » Fri Apr 30, 2004 5:54 am

:roll: Wel, I've tried most everything suggested here and elsewhere, also, and even upgraded my hard drive. I've run scan after scan after scan and there's nothing in there. I did have a couple of the big ones get in when it crashed once and while I was changing out disks. And Norton was on when it hit the last time. But the IRC virus isn't in there. It only tries to infect me while I'm on mIRC. My anti virus catches and cleans it, but it gets aggravating seeing it pop up and I'm just there to have fun. I had re down;oaded my trend Micro anti virus and put my registration # in and two days later got an email that my reg # was pirated. I brought up the screen, and the number I put in there had been changed along with how I registered my name. I don't know what's going on, but something's fishy. I bought my anti virus online from the company, I didn't need a pirated reg #. There's several things that has happened that's fishy, but I won't keep on. I'll just go play trivia and let my anti virus catch and clean it like one of the techs said he did. And If anyone can help me unravel this mess, thanks in advance. menopausi
I don't suffer from insanity, I love every minute of it!
User avatar
Osc
Posts: 75
Joined: Mon Aug 11, 2003 8:08 pm
Location: Atlanta, GA

Postby Osc » Fri Apr 30, 2004 1:26 pm

If the insturctions available via the link munky posted to the trend micro site doesn't get rid of it, contact trend micro:
http://www.trendmicro.com/en/support/contact.htm
irc.he.net Notice -- Osc (osc@irc.packetmonkeys.com) is now an operator
<CHANFIX> You're now logged in with the following flags: ADMIN.
<OCF> Authentication successful. Welcome, Osc.
User avatar
slushey
Posts: 43
Joined: Sat Aug 09, 2003 4:11 pm
Location: Newfoundland, Canada

Postby slushey » Fri May 21, 2004 12:10 pm

There was a problem with PC Cillin that made it think any mIRC open was BKDR_IRCFLOOD.X. The last I heard, however, this problem was resolved. Try updating your Virus Definitions. Hope this helps.
Humor is the best sense we ALL have in common.

slushey ....just me
nothing more.....nothing less

"In Canada we play Duck, Duck, Moose."
tetedupet
Posts: 13
Joined: Thu Feb 12, 2004 7:13 pm
Location: Cambridge, UK
Contact:

Postby tetedupet » Sat Jun 05, 2004 6:06 pm

I always understood this one to be a mistake on TrendMicro's part... I heard it was detecting legit mIRC files as infected. Has anyone actually discovered this without Trend's products? If so, contact me online in #dmsetup or something, I'd be very interested to hear.

tetedupet

Who is online

Users browsing this forum: No registered users and 4 guests