Home Malware Programs Worms Not-a-virus:Client-IRC.Win32.mIRC.g

Not-a-virus:Client-IRC.Win32.mIRC.g

Posted: August 10, 2011

In many cases, Not-a-virus:Client-IRC.Win32.mIRC.g is a harmless false positive that's triggered due to the similarities between certain IRC programs and hostile Trojans. However, in other instances SpywareRemove.com malware research team has found Not-a-virus:Client-IRC.Win32.mIRC.g to be linked to genuine Trojan infections, including spyware that steal private information, adware that display hazardous advertisements, backdoor Trojans that attack your security and dropper Trojans that install other types of malicious software. Note the symptoms of each type of Not-a-virus:Client-IRC.Win32.mIRC.g infection as described further in this article and act accordingly to ignore or delete Not-a-virus:Client-IRC.Win32.mIRC.g, depending on what type of infection is on your PC.

The Mostly Harmless Nature of Not-a-virus:Client-IRC.Win32.mIRC.g

Not-a-virus:Client-IRC.Win32.mIRC.g is a non-virus Internet Relay Chat program that's used for connecting to online chat rooms. SpywareRemove.com malware researchers have found that this detection occurs consistently when certain brands of security programs detect an installation of mIRC. Although Not-a-virus:Client-IRC.Win32.mIRC.g can be exploited by some hostile attackers, by itself, Not-a-virus:Client-IRC.Win32.mIRC.g is a benevolent program that will never hurt your PC.

If you're certain that Not-a-virus:Client-IRC.Win32.mIRC.g is the only infection-related detection on your computer, it's safe to deem it an exception that your anti-virus and other security programs can ignore during their scans. However, since Not-a-virus:Client-IRC.Win32.mIRC.g does have the potential to be converted unwillingly into a PC security vulnerability, it's recommended that you delete Not-a-virus:Client-IRC.Win32.mIRC.g if you're not using it or if you think that you may have serious infections on your computer.

The Hidden Danger of Not-a-virus:Client-IRC.Win32.mIRC.g

Although Not-a-virus:Client-IRC.Win32.mIRC.g isn't a dangerous program all by itself, SpywareRemove.com malware analysts have seen many different infections that use Not-a-virus:Client-IRC.Win32.mIRC.g as part of their strategy to control infected PCs. Some typical Not-a-virus:Client-IRC.Win32.mIRC.g exploiters include:

  • Troj/Merc-A, also known as Backdoor.IRCBot and Backdoor.IRC.BlackCode.a. Troj/Merc-A is a backdoor Trojan that uses Not-a-virus:Client-IRC.Win32.mIRC.g to contact remote servers to receive instructions, download malicious files or upload private information from your PC.
  • Backdoor.IRC.Cloner (also known as TROJ_CLONER.DRP), a second backdoor Trojan that uses Not-a-virus:Client-IRC.Win32.mIRC.g for similar reasons as Troj/Merc-A. In some cases, these two Trojans may even coexist in a bundled installation package.
  • Trojan.RunKeys, a Trojan that assists other harmful programs by installing Autorun exploits for them. This allows these Trojans and other infections to launch themselves automatically, as well as spread to other computers that share the infected PC resources.

Other variants of Not-a-virus:Client-IRC.Win32.mIRC.g detections, such as Not-a-virus:Client-IRC.Win32.mIRC.603, Not-a-virus:Client-IRC.Win32.mIRC, Not-a-virus:Client-IRC.Win32.mIRC.601, Not-a-virus:Client-IRC.Win32.mIRC.621 and Not-a-virus:Client-IRC.Win32.mIRC.60 can pose similar risks, although they may not trigger the aforementioned false positive warning.

Since Trojans that use Not-a-virus:Client-IRC.Win32.mIRC.g are capable of causing serious harm and even allowing criminals to control your PC, SpywareRemove.com malware research specialists recommend that you delete these types of Not-a-virus:Client-IRC.Win32.mIRC.g infections with extreme alacrity.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%ProgramFiles%\mIRC\defaults\scripts\aliases.ini File name: %ProgramFiles%\mIRC\defaults\scripts\aliases.ini
Mime Type: unknown/ini
%AppData%\mIRC\scripts\aliases.ini File name: %AppData%\mIRC\scripts\aliases.ini
Mime Type: unknown/ini
%CommonPrograms%\mIRC\IRCIntro Help.lnk File name: %CommonPrograms%\mIRC\IRCIntro Help.lnk
File type: Shortcut
Mime Type: unknown/lnk
%CommonDesktopDir%\mIRC.lnk File name: %CommonDesktopDir%\mIRC.lnk
File type: Shortcut
Mime Type: unknown/lnk
%ProgramFiles%\mIRC\defaults\mirc.ini File name: %ProgramFiles%\mIRC\defaults\mirc.ini
Mime Type: unknown/ini
%ProgramFiles%\mIRC\ircintro.chm File name: %ProgramFiles%\mIRC\ircintro.chm
Mime Type: unknown/chm
%ProgramFiles%\mIRC\mirc.chm File name: %ProgramFiles%\mIRC\mirc.chm
Mime Type: unknown/chm
%ProgramFiles%\mIRC\readme.txt File name: %ProgramFiles%\mIRC\readme.txt
Mime Type: unknown/txt
%ProgramFiles%\mIRC\versions.txt File name: %ProgramFiles%\mIRC\versions.txt
Mime Type: unknown/txt
%ProgramFiles%\mIRC\defaults\servers.ini File name: %ProgramFiles%\mIRC\defaults\servers.ini
Mime Type: unknown/ini
%AppData%\mIRC\servers.ini File name: %AppData%\mIRC\servers.ini
Mime Type: unknown/ini
%ProgramFiles%\mIRC\defaults\scripts\popups.ini File name: %ProgramFiles%\mIRC\defaults\scripts\popups.ini
Mime Type: unknown/ini
%AppData%\mIRC\scripts\popups.ini File name: %AppData%\mIRC\scripts\popups.ini
Mime Type: unknown/ini

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mIRC
Loading...