This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

Malware opening random internet links & slowing computer

45 min read

This thread's last reply is from November 4, 2010, 10:57 AM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

gmn819,
Let's check whether you have any other leftover infected files or settings.
This scan can take a long time (hours), but it is very thorough. Please start it when you can let it finish.
It doesn't remove anything. The report, however, is very valuable.
-----------------------------------------------------
Run an Online Kaspersky WebScan
  • Please go to Kaspersky website and perform an online antivirus scan.
  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the Program and Database downloads have finished, (may take a while), Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As....
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  • Please post the contents of this log in your next reply.


If it refuses to run, let me know.
askey127
Sorry about the long time between replies, just running the scan now, had a lot of other computer stuff to do lately, scan is 45m in, will paste the log when its finished. UPDATE: Scan finished:

Log:

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Monday, November 1, 2010
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Monday, November 01, 2010 00:52:43
Records in database: 4197833
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\

Scan statistics:
Objects scanned: 106270
Threats found: 1
Infected objects found: 2
Suspicious objects found: 0
Scan duration: 02:27:16


File name / Threat / Threats count
C:\Program Files\Mirc\Irc\mirc.exe/C:\Program Files\Mirc\Irc\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 1
C:\Program Files\Mirc\Irc\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 1

Selected area has been scanned.
gmn819,
-----------------------------------------------------------
Remove Programs Using Control Panel
From Start, Settings, Control Panel or Start, Control Panel, click Add/Remove Programs.
Highlight each Entry, as follows, one by one, if it exists, and choose Remove :

Mirc

Take extra care in answering questions posed by any Uninstaller.
-------------------------------------------------------------
  • Open a new Notepad window (Start>All programs>accessories>notepad). Choose File, New.
  • Highlight the contents of the codebox below and press Ctrl+C to copy it to the clipboard. Do Not copy the word "Code".
    File::
    C:\Program Files\Mirc\Irc\mirc.exe

    Folder::
    C:\Program Files\Mirc

  • Paste the contents of the clipboard into the Notepad window by pressing Ctrl+V or Edit, Paste
  • Save it to your desktop as CFScript.txt

  • Now drag and drop the CFScript.txt icon onto combofix.exe (zzz.exe) as in the picture above, and follow the prompts.
  • Then post the resultant log, C:\ComboFix.txt, in your next reply.

-------------------------------------------------------------
You can install a new version of Mirc if you wish. http://www.mirc.com/get.html

Tell me how the computer is behaving.
askey127
Ok I'll remove irc, though I have had the program for years without any problems, I guess it must've got infected..
Older versions of programs like Mirc have been used for a long time by spyware purveyors.
They try to exploit whatever defects or openings they can find in older software.

For a similar reason, it's important to remove old versions of Java and Adobe reader.