MIRC at Startup!

[genistas]

Hi!
I've got a Windows 2000 machine that keeps starting MIRC on startup, and I think it got there through Kazaa. However, it's not in the Add/Remove programs list. Norton antivirus (latest definitions) doesn't detect anything wrong. I've completely removed Kazaa and every program I could find that it has installed. I've checked the startup items in the registry and there's nothing unusual. In fact, I searched the registry and hard drive and removed every trace of MIRC I could find. I've also run Spybot and Adaware, removing everything that it found. I'm at at my wit's end here! Does anybody have any suggestions?
Thanks a million!
-Dan

 

[param4u]

Hey Dan, I think that you must have already taken care of the Run, RunOnce, RunServices in the registry and also you must have taken care of the startup files from msconfig....

What I can suggest you is that there is a simple logic, as you said that the system starts the MIRC - which means that the program file has got to be there somewhere on the system - Just search for mirc32.exe or mirc.exe and delete the same - hope this works or else if this does not help you then the mirc would be integrated into something else that would be probably difficult to get to - but HijackThis will help then... lets hope 4 the best!!

 

[mikesgroovin]

Yea, totally agree.....also....you may just want to take a screen shot of your registry entries in this location. Some of these virus-related/adware related tend to disguise themselves as system services....only difference is that they will add a "_" or something like that.
Post a screen shot and we can give you a good inclination of what processes you do not need to be running.

-Mike

 

[T1junkie]

check the contents of your startup folder and check the msconfig startup options

 

[mikesgroovin]

2000 doesn't have msconfig by default.....Dan would have to copy it and place it into the system root\system32 folder...

http://www.evozero.gamma.timdorr.com/computer-guides/s_startup.htm

-Mike

(Let me know if the pictures aren't showing up)

 

[genistas]

You're right, it doesn't. I don't have the particular computer in front of me, and won't be back to work on it until tomorrow, but I'll take these ideas with me, and if I don't fix it, I'll let you know and post a screen shot. Thanks guys!
-Dan

 

[genistas]

Problem solved and here's what I found. HiJackThis, Adaware, Spybot, and Norton never detected the file running from startup. MIRC was cleverly disquised in the \winnt\system32 folder as task32.exe, which I THOUGHT was a legitimate file. It was only after I dowloaded MSCONFIG and started disabling services and startup items that I narrowed it down to that file.
Thanks for all of your help!
-Dan

 

[mikesgroovin]

Yup, seen that one before....glad you were able to catch it!

-Mike

 

[who.cares]

read my post, nice little program about startup (i think thats what it is called)

POST 30!!!!