# How do I rid my computer of this virus? **URL:** \ **Category:** Factual Questions\ **Created:** [July 16, 2001, 10:16am UTC](https://boards.straightdope.com/t/how-do-i-rid-my-computer-of-this-virus/72657 "2001-07-16T10:16:39Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![The\_Fromesiter](https://avatars.discourse-cdn.com/v4/letter/t/dec6dc/32.png) [@The\_Fromesiter](https://boards.straightdope.com/u/The_Fromesiter)\ **Post date:** [July 16, 2001, 10:16am UTC](https://boards.straightdope.com/t/how-do-i-rid-my-computer-of-this-virus/72657/1 "2001-07-16T10:16:39Z")
Well, I guess I got duped pretty good. Dunno where I got it from, but, something is trying to use an mIRC client to either download from an FTP or upload some data from my comp. I don’t know the limitations of mIRC and its scripting language, but from the files that keep regenerating in a folder in my fonts folder, and what I can understand of what’s coded in them is that I have a script that is attempting to contact and outside host for data transfer purposes. It’s very annoying. Not only in that it’s there, but it tries to run every time I open a program that can use the internet. Thankfully, Zonealarm has stopped all attempts for the program to contact the outside world, at least, I think it has. So, I come to you, my brethren, and ask for assistance. I will give what meager details I have found in my half-hour to an hour of trying to get this virus out of my system. So, what I know: -It regenerates from a source that I cannot locate. -It has with it a program that can view all background programs and make them visible (“Power Meter” “Magnify Feature” “Multimedia Keyboard”). It’s labeled Temp2.exe and has a window title of “HideWindow”. -There is a file that while not responsible for the regeneration, at least I think not, is always executed whenever I open an internet related program. “undelete.exe” It is a self-extracting zip made by SFX Maker. -mIRC script coded into a file labeled tight.txt I understand none of it other than the fact that it wants to communicate outside of my system and I beleive it is attempting to retrieve the status of my ports. -The directory contains a “temp.scr” that I am not going to open. -Directory also contains “shiver.exe”. Run from Dos prompt it appears to be some type of attack or some such. To quote “usage: /WINDOWS/FONTS/TBA1/SHIVER.EXE \ \” Also has a link to: [http://www.nuclearwinter.com](http://www.nuclearwinter.com) -File “servers.txt” invludes one line (edited for content): f_[ckmein.myftp.org](http://ckmein.myftp.org) 6667 -File “script.ini” includes the lines (edited for content): n4=%uplocation [http://192.41.43.73/chicks/Sys32.exe](http://192.41.43.73/chicks/Sys32.exe) n5=%connect.server f_[ckmein.myftp.org](http://ckmein.myftp.org) 6667 and n7=%connect.chan #tba1 n8=%max.load 3 n9=%connect.count 1 n10=%script.pass fearme n11=%xyz f_[ckmein.myftp.org](http://ckmein.myftp.org) #tba1 and n14=%finalb_tch fuckmein.myftp.org-6667-#tba1 -File “mirc.ini” contains general information about my system, such as location of browser and email client executables as well as a process to extract server variable from the main mIRC client. -Also contained in directory are the files “gu.exe” and “cygwin1.dll”. An attempt to extract both files is made when opening a program that can connect to the internet. So, as you can see, I don’t really know that much. That’s why I came here, and posted here. I hope that one of you has the knowledge that can rid my computer of this evil. Please, oh please help me! (and geez, it’s 3AM already, I should be asleep, not trying to solicite the help that might be found in the great collective wisdom here at the SDMB.) ---
**Author:** ![Reeder](https://avatars.discourse-cdn.com/v4/letter/r/c6cbf5/32.png) [@Reeder](https://boards.straightdope.com/u/Reeder)\ **Post date:** [July 16, 2001, 12:17pm UTC](https://boards.straightdope.com/t/how-do-i-rid-my-computer-of-this-virus/72657/2 "2001-07-16T12:17:37Z")
Here’s a couple links discussing temp2.exe… > **[Broadcom Inc. | Connecting Everything](https://www.broadcom.com)** > > Broadcom Inc. is a global technology leader that designs, develops and supplies semiconductor and infrastructure software solutions. [http://www.mail-archive.com/enews\_ipe@listserv.cai.com/msg00012.html](http://www.mail-archive.com/enews_ipe@listserv.cai.com/msg00012.html) ---
**Author:** ![The\_Fromesiter](https://avatars.discourse-cdn.com/v4/letter/t/dec6dc/32.png) [@The\_Fromesiter](https://boards.straightdope.com/u/The_Fromesiter)\ **Post date:** [July 16, 2001, 6:48pm UTC](https://boards.straightdope.com/t/how-do-i-rid-my-computer-of-this-virus/72657/3 "2001-07-16T18:48:43Z")
Thank you for shedding some light on the subject.