1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Unable to delete mirc

Discussion in 'Virus & Other Malware Removal' started by djantmatt, Jan 28, 2003.

Thread Status:
Not open for further replies.
Advertisement
  1. djantmatt

    djantmatt Thread Starter

    Joined:
    Jan 28, 2003
    Messages:
    2
    I have searched your site resolving this problem. I went and downloaded the startup software. I ran startup while mirc was open and am not detecting anything out of place. Here is what was listed:
    Running processes:

    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\System32\ibmpmsvc.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\System32\svchost.exe
    C:\WINNT\system32\LEXBCES.EXE
    C:\WINNT\system32\LEXPPS.EXE
    C:\WINNT\system32\spoolsv.exe
    C:\Program Files\NavNT\defwatch.exe
    C:\WINNT\etlisrv.exe
    C:\Program Files\NavNT\rtvscan.exe
    C:\WINNT\system32\regsvc.exe
    C:\WINNT\system32\MSTask.exe
    D:\PROGRA~1\UMS\Director\bin\twgipcsv.exe
    C:\WINNT\System32\WBEM\WinMgmt.exe
    C:\WINNT\System32\mspmspsv.exe
    C:\WINNT\Explorer.Exe
    C:\WINNT\System32\tp4serv.exe
    C:\WINNT\System32\Promon.exe
    C:\WINNT\System32\ltcm000c.exe
    C:\WINNT\System32\RunDll32.exe
    C:\winnt\system32\taskmngr.exe
    C:\WINNT\loadqm.exe
    C:\PROGRA~1\NavNT\vptray.exe
    C:\WINNT\System32\LXSUPMON.EXE
    C:\WINNT\system32\etlitr50.exe
    D:\Program Files\Microsoft Office\Office\OSA.EXE
    D:\WinZip\WZQKPICK.EXE
    D:\PROGRA~1\UMS\Director\bin\twgipc.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    D:\Program Files\Microsoft Office\Office\Winword.exe
    D:\WINZIP\winzip32.exe
    C:\unzipped\startuplist\StartupList.exe

    --------------------------------------------------

    Listing of startup folders:

    Shell folders Common Startup:
    [D:\Documents and Settings\All Users\Start Menu\Programs\Startup]
    Entrust Login.lnk = C:\WINNT\system32\etlitr50.exe
    Office Startup.lnk = D:\Program Files\Microsoft Office\Office\OSA.EXE
    WinZip Quick Pick.lnk = D:\WinZip\WZQKPICK.EXE

    --------------------------------------------------

    Checking Windows NT UserInit:

    [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    UserInit = C:\WINNT\system32\userinit.exe,

    --------------------------------------------------

    Autorun entries from Registry:
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run

    TrackPointSrv = tp4serv.exe
    Synchronization Manager = mobsync.exe /logon
    Promon.exe = Promon.exe
    XircWinModem4 = ltcm000c.exe 9
    BMMGAG = RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
    AtiPTA = Atiptaxx.exe
    Run32dll = c:\winnt\system32\taskmngr.exe
    LoadQM = loadqm.exe
    systemdrv = ms32sys.exe
    AdobeA = C:\WINNT\System32\adobes.exe
    vptray = C:\PROGRA~1\NavNT\vptray.exe
    LXSUPMON = C:\WINNT\System32\LXSUPMON.EXE RUN
    smbdpmi = D:\PROGRA~1\UMS\utils\smbdpmi.exe
    dllInit ibmasstw.dll = "D:\Program Files\UMS\utils\DLLINIT.EXE" ibmasstw.dll

    --------------------------------------------------

    Autorun entries from Registry:
    HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

    systemdrv = ms32sys.exe

    --------------------------------------------------


    Enumerating Browser Helper Objects:

    (no name) - d:\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

    --------------------------------------------------

    Enumerating Task Scheduler jobs:

    BMMTask.job

    --------------------------------------------------

    Enumerating Download Program Files:

    [Shockwave Flash Object]
    InProcServer32 = C:\WINNT\System32\macromed\flash\Flash.ocx
    CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

    [Microsoft Office Tools on the Web Control]
    InProcServer32 = C:\WINNT\Downloaded Program Files\OUTC.DLL
    CODEBASE = http://officeupdate.microsoft.com/TemplateGallery/downloads/outc.cab

    --------------------------------------------------
    End of report, 4,378 bytes
    Report generated in 0.381 seconds

    History:
    Everytime I boot up the laptop mirc starts up. I have deleted every trace of mirc, including in the registry. Help.
     
  2. tpb

    tpb

    Joined:
    Feb 27, 2001
    Messages:
    573
    It appears you have a virus: systemdrv = ms32sys.exe

    Go here and run an online scan, Let us know what housecall finds.

    http://housecall.antivirus.com/
     
  3. djantmatt

    djantmatt Thread Starter

    Joined:
    Jan 28, 2003
    Messages:
    2
    After running the virus scan from Housecall, 4 viruses:
    c:\winnt\system32\rmvshrs.bat
    c:\\winnt\system32\taskmngr.exe
    c:\winnt\system32\stde9.exe
    c:\winnt\shell\adobes.exe
    All viruses were uncleanable. Thank you for the help.
     
  4. tpb

    tpb

    Joined:
    Feb 27, 2001
    Messages:
    573
    I see most of those other entries now that i've thoroughly looked through the startuplist.
    What operating system are you using? What virus did housecall list?
     
As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/115734

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice