Unable to delete mirc

[djantmatt]

I have searched your site resolving this problem. I went and downloaded the startup software. I ran startup while mirc was open and am not detecting anything out of place. Here is what was listed:
Running processes:

C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\ibmpmsvc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\LEXPPS.EXE
C:\WINNT\system32\spoolsv.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINNT\etlisrv.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
D:\PROGRA~1\UMS\Director\bin\twgipcsv.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\Explorer.Exe
C:\WINNT\System32\tp4serv.exe
C:\WINNT\System32\Promon.exe
C:\WINNT\System32\ltcm000c.exe
C:\WINNT\System32\RunDll32.exe
C:\winnt\system32\taskmngr.exe
C:\WINNT\loadqm.exe
C:\PROGRA~1\NavNT\vptray.exe
C:\WINNT\System32\LXSUPMON.EXE
C:\WINNT\system32\etlitr50.exe
D:\Program Files\Microsoft Office\Office\OSA.EXE
D:\WinZip\WZQKPICK.EXE
D:\PROGRA~1\UMS\Director\bin\twgipc.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\Program Files\Microsoft Office\Office\Winword.exe
D:\WINZIP\winzip32.exe
C:\unzipped\startuplist\StartupList.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Common Startup:
[D:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Entrust Login.lnk = C:\WINNT\system32\etlitr50.exe
Office Startup.lnk = D:\Program Files\Microsoft Office\Office\OSA.EXE
WinZip Quick Pick.lnk = D:\WinZip\WZQKPICK.EXE

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINNT\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

TrackPointSrv = tp4serv.exe
Synchronization Manager = mobsync.exe /logon
Promon.exe = Promon.exe
XircWinModem4 = ltcm000c.exe 9
BMMGAG = RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
AtiPTA = Atiptaxx.exe
Run32dll = c:\winnt\system32\taskmngr.exe
LoadQM = loadqm.exe
systemdrv = ms32sys.exe
AdobeA = C:\WINNT\System32\adobes.exe
vptray = C:\PROGRA~1\NavNT\vptray.exe
LXSUPMON = C:\WINNT\System32\LXSUPMON.EXE RUN
smbdpmi = D:\PROGRA~1\UMS\utils\smbdpmi.exe
dllInit ibmasstw.dll = "D:\Program Files\UMS\utils\DLLINIT.EXE" ibmasstw.dll

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

systemdrv = ms32sys.exe

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - d:\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

--------------------------------------------------

Enumerating Task Scheduler jobs:

BMMTask.job

--------------------------------------------------

Enumerating Download Program Files:

[Shockwave Flash Object]
InProcServer32 = C:\WINNT\System32\macromed\flash\Flash.ocx
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[Microsoft Office Tools on the Web Control]
InProcServer32 = C:\WINNT\Downloaded Program Files\OUTC.DLL
CODEBASE = http://officeupdate.microsoft.com/TemplateGallery/downloads/outc.cab

--------------------------------------------------
End of report, 4,378 bytes
Report generated in 0.381 seconds

History:
Everytime I boot up the laptop mirc starts up. I have deleted every trace of mirc, including in the registry. Help.

 

[tpb]

It appears you have a virus: systemdrv = ms32sys.exe

Go here and run an online scan, Let us know what housecall finds.

http://housecall.antivirus.com/

 

[djantmatt]

After running the virus scan from Housecall, 4 viruses:
c:\winnt\system32\rmvshrs.bat
c:\\winnt\system32\taskmngr.exe
c:\winnt\system32\stde9.exe
c:\winnt\shell\adobes.exe
All viruses were uncleanable. Thank you for the help.

 

[tpb]

I see most of those other entries now that i've thoroughly looked through the startuplist.
What operating system are you using? What virus did housecall list?