Known IRC software bugs

§ script.ini
§ events.ini
§ dmsetup.exe
§ dmsetup2.exe (buny.exe, jnkpower.exe, its variants)
§ *.jpg.com
§ Back Orifice
§ NetBus
The Cleaner - a tool for fixing many IRC software bugs listed above

script.ini

size: under 50K

users affected: users of mIRC that don't have a separate download directory.

cause: script.ini file is accepted via DCC upon joining or leaving channel.

symptoms: inadvertently sending script.ini to others, connection slows to the DCC Sends, people telling you or the chanops that you're sending script.ini, getting banned from your favorite channel for apparently no reason.

cure: Find and delete the script.ini file in your mIRC directory using Windows Explorer. Type /sreq ask in any window to turn off your DCC auto-accept to prevent acquiring script.ini (or other sent files) again.

Restart mIRC.

The most advisable course of action is to upgrade to the latest version of mIRC which not only creates a new download directory, but also warns upon the sending of such files. mIRC can be downloaded here.

Note: This file can be removed automatically using The Cleaner, by puppet. Click here for more information regarding The Cleaner.

events.ini

size: at least 1,829 bytes

users affected: users of Pirch that don't have a separate download directory; this is the Pirch equivalent of the mIRC worm script.ini

cause: events.ini file is accepted via DCC upon joining or leaving channel.

symptoms: inadvertently sending events.ini to others, connection slows to the DCC Sends, people telling you or the chanops that you're sending script.ini, getting banned from your favorite channel for apparently no reason.

cure: Find and delete the events.ini file in your Pirch directory using Windows Explorer. To prevent this from happening again, disable your DCC auto accept by clicking on Prefs and choosing the DCC tab and unchecking "Auto Accept Files" and pressing "Ok."

Restart Pirch.

dmsetup.exe

size: ~57,556 bytes

users affected: all Windows users

symptoms: inadvertently sending the dmsetup.exe file to others, connection slowed by the sending of this file, people telling you or the chanops that you're sending script.ini, getting banned from your favorite channel for apparently no reason.

cause: dmsetup.exe file is accepted via DCC upon joining or leaving a channel. the trojan horse only becomes a problem when the exe file is run.

cure: Delete the following files from your hard disk: any and all dmsetup.exe files, they include:

C:\dmsetup.exe
C:\program files\dmsetup.exe
C:\windows\dmsetup.exe
C:\mirc\dmsetup.exe
C:\mirc\mirc.ini
C:\configg.sys

Open C:\autoexec.bat with Notepad. Remove any references to dmsetup.exe in the file and then save and exit.

Note: dmsetup.exe can automatically be removed using The Cleaner, by puppet. Click here for more information regarding The Cleaner.

dmsetup2.exe

size: ~81,084 bytes

morphology: can be distributed under many different names including lovepee.exe, buny.exe, jnkpower.exe, etc.

users affected: all windows users

symptoms: sending a file inadvertently to others, connection slowed from sending the file, mirc title bar may read "your mirc is buggy".

cure: Find the exe file and delete them: directories of proliferation may include:

C:\
C:\windows
C:\mirc
C:\windows\system
C:\youarenotsupposedtobelookingatthis
C:\program files
C:\dos
C:\quake
C:\quake2
C:\doom
C:\doom2
C:\games
C:\pics
C:\_DM2IYF <-- ascii255 is first character
C:\SUCK_IT <-- ascii255 is the separator.

to delete the C:\_DM2IYF and C:\SUCK_IT folders, open a DOS box and type deltree ** where ascii 255 is entered by pressing the Alt key followed by "255" on the keypad.

delete the file c:\taged.lmr

delete C:\mirc\mirc.ini delete C:\ni.cfg

delete C:\mirc\dmsetup2.ini or ini file name corresponding to the name of your exe file.

rename bakupwrks.ini to mirc.ini, if unsuccessful, reinstall mirc.

Note: dmsetup2.exe and its variants can automatically be removed using The Cleaner, by puppet. Click here for more information regarding The Cleaner.

*.jpg.com (variant of dmsetup2.exe)

size: ~81,084 bytes

morphology: looks like a picture file but actually is a an executable trojan horse; can distribute itself under many different names.

users affected: all Windows users

cure: none recommended

Back Orifice

size: 124,928 bytes or larger

morphology: can have many names, especially blank characters such as " .exe" where the filename is a simply a space.

users affected: Windows 95/98 users

synopsis: Back Orifice is a remote administration tool that allows a user to gain access to almost any program on your PC. It installs itself to your Windows system directory and affixes itself to the Windows registry so that the remote access server starts each time you reboot. Needless to say, it compromises the security of your Windows machine.

symptoms: The Back Orifice application will be installed to your \Windows\System\ directory under one or more filenames. It also creates a file windll.dll under the same directory.

It will create a registry value to load the application under the following key under HKEY_LOCAL_MACHINE: \SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

The entry for this key will match the Back Orifice application executable, e.g., " .exe" .

This can be viewed by using the Windows registry editor, Regedit, which can be run by going to Start > Run and then typing in "regedit" and choosing "Ok". cure:

Remove the value under the registry key mentioned above by right-clicking on the value " .exe" itself in the registry editor and choose "Delete."

Delete the windll.dll in your \Windows\System directory.

Shutdown and restart. Delete the Back Orifice application itself, e.g., " .exe".

Back Orifice can automatically be removed using The Cleaner, by puppet. Click here for more information regarding The Cleaner.

NetBus

morphology: commonly assume names patch.exe and game.exe, but can assume any executable filename

synopsis: NetBus is a remote administration tool that others can mailicously use to gain access to your system. It installs itself to your Windows directory while being started with registry entries. Like Back Orifice, your PC stands to be compromised.

symptoms: Unknown breach in security, accesing passwords, etc., and most typically, your CD-ROM opens and closes on its own.

cure: Telnet to your own IP at port 12345. This can be done by a /dns nick. You will be able to find the NetBus version this way. If this doesn't work, try port 20034.

Visit http://split.netset.com/netbusfix/ and load the page corresponding to your version.

Disconnect from your ISP and follow the instructions.

The Cleaner

The Cleaner, developed by puppet, is a remover of various backdoors, trojan horses, and ini worms that may exist on your PC including many of the problem files listed above. Updated frequently, it is an up-to-date tool for removing various files quickly and painlessly. It can be downloaded here.