Biggins

I'm after a little help.

I can't open the Task Manager on my laptop. When I use Ctrl-Alt-Del it will pop up for a second and then dissapear leaving a small green sqaure on the toolbar at thr right. You can repeat this and it will leave more green squares but won't run Task Manager more than the brief glimpse. When you move the mouse pointer over the green squares, they disappear before you can click on them.

I think it is connected to a couple of Viruses that I have just eliminated using "Stinger" and spyware/adware wotsits that i've just rid with "Ad-Aware SE" & "Spyware Doctor". My OS is Windows XP Home and the Laptop is a P4 3.2.

2 of the items Stinger found were "Application Hide Window" found in C:\WINDOWS\system32\dir32.exe\dir32.exe & C:\WINDOWS\system32\gone.exe\gone.exe. These could not be repaired and were deleted.

I have downloaded Process Explorer from www.sysinternals.com and am running this in place of Task Manager. Problem is I really don't know what i'm looking at in Process Explorer and what applications, .dll etc. need to be killed.

Any help on how to put things right would be most appreciated.

Many thanks

p.s. my dial up Internet has become very pedestrian also, whereas using the same dial up from my desktop pc is x20 faster, could this be related? Again, i guess Proces Explorer should be able to tell me whats running during Internet Explorer.exe.

Biggins

Nobody????

Nicks VR4

Read this might help

http://www.mvps.org/sramesh2k/ToolsQuit.htm

Did you use the latest version of stinger? 2.40 came out yesterday

Biggins

Nicks VR4

Thanks for the tip off. I was using Stinger v2.30. I downloaded the new v2.40 and it has got rid of the W32/sdbot.worm virus that was present. My Task Manager/Regit windows now operate properly.

The only thing i'm left with now is mIRC32 window which opens on startup. It is some sort of chat device.

Anyone know how to fix this one?

bioforger

iTrader: (1)

Mirc is an internet relay chat client, by itself its harmless, in your case it sounds like its going to be harmfuk My oh my u got yourself nicely infected havent u! Check msconfig, startup folder for the mirc startup problem. It might even be listed in add/remove programs. Ive not heard of mirc being used as a trojan or virus spreader, if u didnt actually install it yourself! Have u considered a format n reinstall? Might be best

Nicks VR4

You may still have a worn/virus on your machine plenty of Worms infect mIRC32.exe if installed on machine

You dont mention having any Antivirus software running if not get some fast
You could also go to McAfee , Trend or Panda and do a online scan

Nick
-------------------------------------------------------
A snipet of a worm infecting mIRC32

mIRC script
The virus looks for an mIRC client installed in the system and creates a new SCRIPT.INI file in the same directory. The virus looks for mIRC in six directories and does not drop its mIRC component if none of the directories is found:

C:\MIRC
C:\MIRC32
C:\PROGRAM\MIRC
C:\PROGRAM\MIRC32
C:\PROGRA~1\MIRC
C:\PROGRA~1\MIRC32

While infecting the mIRC client, the virus uses the same trick as other mIRC viruses do: it overwrites the standard mIRC script file SCRIPT.INI with an infected one. When an mIRC client starts with an infected script, it accepts this file and follows its instructions.

The infected SCRIPT.INI contains several commands. The main one is the virus-sending instruction: when any user sends/receives any files, the virus sends to this user its infected dropper file, PORNO.COM.

The virus also sends messages to the channel and users on the channel. When an infected client connects to an IRC server, the virus sends the message to a user with the "SeptiC_dm" nickname:

Biggins

Nick,

I managed to rid mIRC32 on the Add/Remove Programs utility although it said that some files it was unable to remove.
Everything appears now to work as it should so i'm a happy chappy again.
I am getting the lastest copy of McAfee Internet through the post to install prior to going online again. I am also running free downloads of Ad-Aware SE, Spy Doctor 2.1 (scans on start-up) and have the v2.40 of Stinger to throw at it now and again.

Are there any other software packages I should be thinking about before going back online?? I will soon be downloading lots as i'm switching to broadband so want to be fully protected.

Thanks for all your help with this one.

Nicks VR4

Hi Biggins,
Nice one

McAfee is a good choose IMHO ex-employee lol

You could spend days just downloading different Spyware .Adware etc etc
Not very exciting

I would recommend CW shredder if you havent got that and also a small GUI called DCOMbob
DCOMbob tests your machine for various open ports and can close some of them for you
http://www.grc.com/dcom/

Cheers Nick