mirc dcc and security guide

Why are there so many problems with this new technology?

All the internet cares about is the IP address it sees. If you have 2, 5, 10 computers linked, and all show the same IP address, how is the internet supposed to know there is more than one computer? When you try to DCC, all the computers on the network are showing the same IP, the one your ISP assigned to the gateway machine. When the client computer tries to initiate a DCC, it isnt reporting the correct information to the computer at the other end, which then cant find the initiating computer. (SEE What causes DCC problems) Because of the spread of virus files, and denial of service attacks by people who need to get a life, many users and providers are using devices to block access, which effects DCC sends. Some of these can be adjusted if you know how to, others can't.

Some Basics

Is your problem with both sending and recieving, or only with sends? The ability to recieve, but not send can be caused by several things, while both being blocked tend to be caused by ipmismatch or scripts. Check for an ip mismatch
type /dns yournickname
type //echo -a $ip These two numbers, the one you see when you type //echo -a $ip, and the other from the number portion of what you get from typing /dns yournickname must be the same. If they arent, type /localinfo -u and check again. You may need to disconnect and in File / Options / Connect / LocalInfo, clear the local host and ip address boxes. Check on connect always get local host, and try using server as the look up method instead of normal. (SEE Easy Fix and What causes DCC problems)

Does your ISP have you firewalled?

No, they dont always tell you, you will have to specifically ask. Just because they didn't have a firewall before, it doesn't mean they still don't. If they do, you can ask to have some ports in the 1024 to 5000 range opened, and set the open ones in File / Options / DCC / Options in the DCC port boxes.

Have you tried with more than one person?

The user on the other end could be the one with the problem. Do they have an ip mismatch? Is the file type being sent ignored in options? (file / options / dcc / folders) Some file types the servers will block (like .exe .ini) and the receiving person must type /dccallow +yournickhere. Unable to resolve local host error message.

1. The user you are sending to doesn't resolve.
2. Your mIRC didn't grab your proper IP Go to: file/options/connect/local info - Under on connect check Local Host and IP. You may need to change the lookup method to Server so that your internet IP is found instead of you local IP. Close mIRC and reconnect
3. You have a Network/Firewall/Proxy which interferes. On networked systems, usually 1 computer is connected to the internet, the other computers have private network addresses. Port mapping allows the gateway computer to pass info correctly between the client computers and the internet. The ports mapped must also be set in file/options/dcc/options. (SEE Networks) With firewalls, specific ports need to be opened. (see Firewalls) You will need to forward a specific port (or range) to each PC for DCC and then change the settings on each copy of mIRC to use those specific ports for DCC. By default mIRC randomly uses a port between 1024 and 5000. An example forward all traffic on port 2000 to PC 1 and all traffic on port on port 3000 to PC 2, etc. Then in the mIRC Options, DCC, Options on PC 1 set the First and Last DCC port to 2000, on PC 2 set First and Last DCC port to 3000, etc.

Were you able to DCC without problem at one time? If so, what has changed?

• If you added any scripts, try again after typing /remote off (to turn them back on, type /remote on).

• If nothing has changed, call your ISP and see what they have been up to.

In general, you won't be able to resume a file from behind a router or machine that is doing NAT on your connection. You could try checking with the hardwares manufacturer, but not many have reported success.

CABLE

Some users have resolved their DCC problem by doing the following:

1. Be sure the cable provider doesn't have you firewalled.
2. While disconnected, in File/Options/Connect/Local info, under on connect always get, clear both the local host and the grayed out ip address boxes.
3. In Windows control panel/internet options/connection, change both modem and LAN settings to "automatically detect"

DSL

1. The problem could be at the DSL/cable modem. Does the provider have you firewalled?
2. Do you have access to the DSL settings? You can telnet into some, with a text-only configuration, and you can web into others with password protected access. Some have built in firewall/routers that you may or may not be able to adjust. The provider may have set up very restrictive settings, or they may be that way by default until you change them. If you can web-administer your unit, the fix will vary depending on the device in question. Get the model number of your unit, and go to the maker's website. See if it is "integrated router" or "integrated firewall" type. Settle in, and start reading the configuration documents at the makers site :) Note that some settings can only be adjusted from the ISP level, while others could be adjusted by the user, but only if the ISP allows the user access.
   Example for Cisco 678:
   1. Telnet to your router's IP address (also known as your 'gateway').
   2. Type the router password and press enter.
   3. Type 'enable' (without quotes) and press enter.
   4. Type the router password again and press enter.
   5. The next line must be typed for each port you wish to use for DCC... set Nat entry add TCP
      1. inside ip - your computer's IP address
      2. outside IP - your router's IP address (the gateway)
      3. inside port, outside port (both are the same): You may choose any set of 10 or 11 ports (or more, or less), but suggest using 4990,4991,4992...to 5000.
      4. If you do choose different ports, they must all be 'in a row', and they must be between 1024 and 5000.
      5. also 'adding' port 113 (to allow identd) but if you can connect to DALnet without it, you don't have to.
   6. Set your client to use the 10 or 11 ports you chose. If you use mIRC, this option is in the DCC Options section (it's called 'DCC Ports', and allows you to set the first and last ports - 4990 and 5000).
   LinkSys
   Linksys routers can cause problems with Ident. DalNet enforces Ident servers, which dont always show up. mIRC has a built in Ident server, which is active, but if it is blocked by a built in firewall, nothing can connect to it. You can try going into the LinkSys Admin panel, and setup DHCP Forwarding, it should allow you to host servers, which is what needs to be run. This is not exactly DHCP Forwarding, so consult your manual regarding unsetting server/port blocking. You could also try:
   1. go to router (http://192.168.1.1)
   2. login
   3. go to Advanced
   4. Go to DMZ Host
   5. Insert your local Ip there (192.168.1.???)
   6. click Save Options
   7. click continue.
   8. Its done :)
3. ICS (internet connection sharing, a windows feature) Microsoft has a support issue on dcc'ing with mirc with ics. http://support.microsoft.com/support/kb/articles/q227/1/48.asp?FR=1 you must create access thru the dcc ports by mapping around ther ics server

Firewalls

A dedicated gateway machine with special security precautions on it, used to service outside network, especially Internet, connections and dial-in lines. The idea is to protect a cluster of more loosely administered machines hidden behind it from crackers. The typical firewall is an inexpensive microprocessor-based Unix machine with no critical data, with modems and public network ports on it, but just one carefully watched connection back to the rest of the cluster. The special precautions may include threat monitoring, call-back, and even a complete iron box keyable to particular incoming IDs or activity patterns. Personal software firewall programs can also be used for the same intent, but do not create the same problems as a dedicated gateway machine, since you can adminster them easily to allow access as you choose. These can be "a stateful firewall". A stateful firewall is the kind that is intelligent. It detects and tracks the STATE of the User's connections and if it detects an inbound connection that is part of what the User has already initiated, it'll allow that to go through. Firewalls become a problem with DCC sends when they block the needed ports. By default, mIRC sets dcc ports at 1024-5000.

NAT (Network Address Translation)

NAT routers: This means that you have an IP on your local computer for a "private network". You will need to configure your DCC Options to a few specific ports, and then configure your router to forward all inbound connections for those ports to forward to your LOCAL IP address. The router IP (what the IRC Server sees you connect as) is the IP address you want mIRC to think you have. /localinfo -u will ensure that is updated (check this in the Options as well and use "server" method). (set your mirc to 'normal lookup' if you're behind a Linux gateway using NAT kernel 2.4 and net filter)

LAN

Be sure that mIRC is recieveing the external IP and not the internal IP. Port forwarding is used on LANs for mIRC to properly connect a remote computer with yours via DCC.Generally, port forwarding is done by whatever plays a gatekeeper. Be it a PC with two network cards, or a dedicated piece of networking hardware, or software like IPFilter. You have to open up at least 2 ports for dcc, within the range of 1024-5000, and put those ports into file>options>dcc>options. Example: use range of 4176-4186.

NETGEAR

Many people are having problems with Netgear routers, rt311/rt314. This is not a problem with mIRC. They seem to cause the client to abort the connection during dcc sends. http://www.practicallynetworked.com/support/netgear_3_25_relnotes.txt    or http://www.practicallynetworked.com/support/netgear_3_25_relnotes.txt, state that "mIRC version 5.31 is supported. This software does not support mIRC DCC after version 5.31." From what we understand, what appears to be happening is a flood, as if the client keeps sending requests through the server to the receiving client that aren't answered, until eventually the client floods itself out. Some people think these routers are somehow blocking the message that says "ok, I got it, you can stop sending now". Some users have said that as long as they dont use port 6667 to connect to a server, they don't have any problem. It may be that Netgear has something hardcoded in for that port. There are a list of ports at the "Unofficial" NetGear RT311/314 User Support site => http://pages.infinit.net/neo2048/frame.htm). While pdcc and fsend really shouldn't have any effect, you can try typing /pdcc off and /fsend off to see if that makes any difference.

Quick Reference Menu to the data that follows

This set of links is to other parts of the page.
You can click on any and go directly to that area.
To get back to this list after you have clicked,
use your back button (in your browser).
You can, at your option, just scroll down and read
as you go through each topic.

What is DCC
What Causes DCC Problems
Easy Fixes
Tia/Twinsock/Slipknot
Dynamic IP
Static IP
Windows Bugs
Norton Desktop
Long Filenames
PROXY
College/School/Work ISP
Enhaning DCC Speeds
DALnet specifics
DCC Server
XDCC/Fserve(Fileserver)
DCC Security

DCC (which stands for Direct Client to Client connection) allows you to connect directly to another IRC client, instead of going through the IRC Network, to Send and Get files, and to Chat privately over a more secure connection. By default, mIRC will pop up a dialog asking you if you want to accept the file.

• file/options/dcc:
  • auto-get:
    mIRC will automatically accept the file if the file type is not being ignored, and for some file types, if you have added the sender to your dccallow.
  • ignore all:
    all incoming dcc send requests are ignored.
• file/options/dcc/folder:
  • File types:
    you can edit the file types you choose to accept and the ones to ignore. Be aware that some servers require you /dccallow +nickname for certain file types, like .exe and .ini (see DALnet Specifics)
  • NOTE:
    If the file type is the problem, you will see a notice telling you that either the file type is being ignored (by your mIRC settings) or that you need to /dccallow the sender (server notice)

If you choose to accept the file, mIRC will ask the sender to begin the file transfer, at which point you should begin receiving the file. If someone tries to send you a file that already exists in your get directory then you will be shown a warning that the file exists. You then have the option to either overwrite the file, resume the transfer, or rename the file. If you choose to overwrite the file then the whole file will be downloaded from the beginning and any existing file of the same name is erased. If you select resume then mIRC will attempt to negotiate a transfer resume to get the remaining part of the file.

There are many causes that can lead to DCC send errors, but to start out, you need to understand the basics. When you DCC someone, the following process takes place:

1. You send a notice to the person you want to send to:
   -Yournick- DCC Send filename YOURIPADDRESS
2. Their mIRC initiates a connection to YOURIPADDRESS

If YOURIPADDRESS isn't correct, then the transfer will never take place - it's trying to go to an address that isn't assigned to you. This could be caused by a simple ip mismatch on either end, easily corrected by typing /localinfo -u.

However, if you are running any type of software (or your ISP is) that controls/monitors incoming connections, this may not allow the user to get through to you. This software is known as firewalls, proxies, routers, wingates, ICS, and other multiple PC internet connection supporting software. This problem is common with cable and DSL connections.

This is also why you are able to receive but not send - think of the connection process backwords... when you send a file, the other user connects to you, when someone sends you a file, you are connecting to them.

Built into mIRC 5.8 and newer, are commands called /localinfo -u and /localinfo -h They are described in the help file as:

1. type: //echo -a $ip
2. type: //dns $me - You may not be able to get a reply to the DNS command, which means your address is numeric (and your names server is down). Simply compare your numeric address Yournick!identd@numericaddress with the //echo -a $ip data. If the two numbers don't match press alt E, goto the local info tab, put the resolved address in Ip address block click on connect always get local host.
3. Try to DCC Send a file to someone

*** DCC Send requests pop up a dialog
*** DCC Send requests are auto-accepted

You do not want them to have:

*** DCC Send requests are ignored

With the Normal method, mIRC relies on your winsock to reply with the correct information. With the Server method, mIRC looks up your local host through the IRC Server, and then performs a /dns on it to resolve it to an IP address. The Server method will most likely be slower, you can tell when it has been completed when you see your local host name and IP address displayed in the status window.

Note: If changing the above switches still doesn't solve the problem, or you don't know what to enter for your local host or ip address, contact your internet provider or system administrator.

If you use TIA (The Internet Adapter) or Twinsock, at this point you cannot use DCC send or initiate DCC chat (with any IRC client, not just mIRC). You may want to try SLiRP or vTCP. SLIRP was the first SLIP emulator to allow DCC sending and initiating DCC chat. (As you know DCC get should always work fine, whatever connection you have. Besides a firewall blocking you that is.) Virtual TCP is tested and proofed to allow DCC sending and chatting.

If you have dynamic IP (your IP address is different each time you log on), make sure that "On connect, always get:" in the File/Options/Local_Info dialog is set to get the Local Host and IP Address. If these were already set to ON make sure the correct 'local host' name and 'IP Address' are found by mIRC... on some winsocks this is rather tricky... If you have a non-compliant stack, mIRC may not be able to correctly find your local host (domain name) and IP. With dynamic IP addressing you are in trouble then !! DCC file sending and initiating a DCC Chat (contrary to file getting and accepting a DCC Chat) requires that mIRC knows your correct IP number. Even without an IP number at all, mIRC will work as far as normal chatting is concerned, but won't allow DCC file sending or initiating a DCC Chat.

If you have a non-compliant stack, mIRC may not be able to correctly find your local host (domain name) and IP. In the File/Options/Local_Info dialog, uncheck the options to "Always get the 'Local Host' and 'IP Address" and manually enter your correct Local Host and IP.

A known Windows95/98/2000 bug causes some people to report that mIRC (and any other IRC program) gets/finds the old (now wrong) Local Host name and/or IP Address after switching Internet provider. This blocks their capability of DCC Sending files and Initiating DCC Chats. If, for some reason, no matter what you do, mIRC picks the user ID (Local Host name) from the Internet Service Provider that you no longer wish to use this is fixable by editing the registry. If you open Regedit and look at MyComputer \HKEY_LOCAL_MACHINE \System \CurrentControlSet \Services \VxD \MSTCP you will see the Domain and NameServer fields from your old provider. These fields will persist even if you uninstall Dial-Up Networking and re-install and go through the TCP/IP settings again. The best way to solve the described problem is going to Start/Settings/Control_Panel/Network/ double click on TCPIP/ select DNS_Configuration/ and set the HOST field to the hostname (ID) you have on your new provider.

CAUTION: Use extreme caution when in the registry. An error here can create a nightmare with Windows, even to the point of Windows not functioning at all.
It is STRONGLY suggested you do a back up before you start playing in registry. Anything done in the registry should be done only by very experienced users.

Some people experience DCC File Send problems with mIRC on a windows system with Norton Desktop installed. mIRC then suddenly shuts down completely (sometimes with an error message) as soon as you try to select a file to send. The problem is that Norton Desktop's feature called 'File Assist' conflicts with mIRC's DCC Send dialog. If you shut off File Assist entirely it will allow DCC transfers fine. Even just disabling the "3D look and feel" in the File Assist options menu helps already.

Some people have reported DCC problems while using this software, although most users don't have any problems. Try turning ZoneAlarm off and see if you can DCC send. Be aware that some ISPs do not like devices that block their own scans.

If you use Windows95/98/2000 mIRC allows you to send long file names with spaces in them, but other IRC programs very often cant handle this. This might cause your transfers to fail. You might want to select mIRC's option to fill (up) spaces in file names by an underscore. This option can be found in the DCC send dialog box (click on the dcc send icon).

Another program known to give DCC Send problems is a software package called Long File Names by View software. It is something you might be running in the background and you might never think of it as the cause of your troubles. The problem is that when you use the DCC Send option in mIRC, the dialog that pops-up doesnt allow you to select files so you can't send anything. Selecting files is blocked by LFN and if you disable the LFN software all your DCC problems will be solved.

The DCC protocol doesn't take into account the possibility of a filename containing spaces, so most if not all IRC clients will incorrectly interpret the following DCC Send message:

• PRIVMSG nick :DCC SEND This is a long file name with.spaces in it ipaddress port filesize.
Thus mIRC gives you the Fill Spaces option; this fills spaces in a filename with the underscore character _, which should then allow other clients to interpret the message correctly. So other clients would see:
• PRIVMSG nick :DCC SEND This_is_a_long_file_name_with.spaces_in_it ipaddress port filesize.
  

  If the Fill Spaces option isn't selected then mIRC sends "Long File Names with.Spaces in them" enclosed in quotes. For example:
  

• PRIVMSG nick :DCC SEND "This is a long file name with.spaces in it" ipaddress port filesize

As far as we know, only mIRC can send and receive messages of this form (and only versions 3.8 and onwards), so if you try using this dcc send message with other clients it probably won't work.

As far as I understand it is totally impossible to get DCC Sending working when you're behind a proxy. You may try the DCC Server section.

It's important for you to be aware that some network administrators protect their server by not allowing incoming connections. This can be done with firewalls and such on the server side, and cannot be overridden by end users. Most suffer from not being able to DCC send, the only option is to ask the sysadmin to allow incoming connections. Do not be surprised when he says no.

Packet Size
The packet size is the number of bytes that mIRC will send to another client in one packet. The minimum is 512, the maximum is 8192. Which is best? Hard to say, since it will vary from connection to connection. If a send is going much slower than normal, the connection between you could have a lot of "hops", or high traffic. Try using a smaller packet size.
command: /dcc packetsize 8192

Fill Spaces

The fill spaces option is only available in the 32bit version and only under operating systems that allow spaces in filenames. It is highly recommended that you leave this option turned on. For more information, while in mIRC, type /help long file names (also see Long file names on this page)
command: check Fill spaces after typing /dcc send

Fast Send

Turning on this option should speed up your DCC sessions.
command: /fsend on

Pump DCC

Basically it just sends N bytes ahead of sent data without waiting for the other client to reply "Acknowledged".
In versions 5.8 and newer, you can only do /pdcc on | off, specifying a number makes no difference now. Nearly every user will never be able to send more than 25000 ahead, this is due to the limitations of current system mediums and bandwidth.
command: /pdcc on

Note: 99999999999 is just ignored

Note: Slower than usual sends, combined with a memory link on Win98SE with more than 256mb of memory have been reported.

Basically Win98SE will use all available memory for its disk cacheing. No limits are set by default. The file activity of the DCC sends can cause the cache to fill up rapidly.

WARNING: We do not support making any changes to your system.ini file. That is something that should only be done by an extremely experienced user.

Modems
The faster the modem, the quicker the send - be aware that the send steps down to the speed of the slowest modem in use.

DCCALLOW - A new system that prevents the spread of executable or dangerous scripts without the permision of the user recieving them. The DCCALLOW system prevents transmission of "exe", "com", "bat", "dll", "ini", "vbs", "pif", "mrc", "scr", "doc", "xls", "lnk", "shs", "js" and "pl".

command specifics: /DCCALLOW [<+|->nick[,<+|->nick, ...]] [list] [help]

example: /dccallow +joeuse

Without dccallow set you would see a message like this
(if trying to send a file of this type):

The user Somenickname is not accepting DCC sends of filetype *.EXE from you. Your file filename.exe was not sent.

And Somenickname would receive:

-Servername- Yournickname (address) has attempted to send you a file named filename.EXE, which was blocked.
-Servername- The majority of files sent of this type are malicious virii and trojan horses. In order to prevent the spread of this problem, we are blocking DCC sends of these types of files by default.

If you completely trust this person, you would type /dccallow +nickname and you will see:

nickname has been added to your DCC allow list

After you are done, it is wise to remove them from the list, by typing /dccallow -nickname and you will see:
nickname has been removed from your DCC allow list

You may list your allowed users by typing:
/dccallow list
You will receive:
The following users are on your dcc allow list:
nickname (address)
End of DCCALLOW list

This is how you can bypass the reverse method of DCC. The receiving user must have DCC server on and listening for the appropriate type of DCC you intend on sending. Please note that it is recommended that you disable this when the DCC is complete, and enable it on a user to user basis.

usage: /dccserver [+|-scf] [on|off] [port]

example: /dccserver +scf on 59

The mIRC DCC Server listens for direct connections to your IP address from other mIRC clients. In options (alt D, o) , you can set the following:

Enable DCC Server ([on|of])

This turns the DCC Server on or off.

Listen on Port ([port])

The DCC Server listens on port 59 by default, however you can change this to another port number.

Listen for... ([+|-sfc])

You can have the DCC Server listen for only certain types of connections, such as DCC Sends, Chats, or Fileserver requests. For example, if you turn off the DCC Chat listen option, the DCC Server will ignore any chat requests.

Perform DNS lookup

When someone connects to your DCC Server only their IP address is available for identification. If you check the DNS lookup switch, mIRC will perform a /dns on the IP address to try to resolve it to a named address. Note: It can take anything from a second to more than minute to resolve an address depending on network conditions, and sometimes it may not resolve at all. You can Send/Chat to the DCC Server using the DCC Send/Chat dialogs and specifying an IP address instead of a nickname.

To send using the DCC Server: you use an IP address instead of a nickname to initiate a connection

usage: /dcc [send|chat|fserve] IPADDRESS:PORT

The IP address can be numeric or alphanumeric, to obtain this data do a whois on the person you want to send the file to(/whois nickname). You will see the following (unless you are using a script that filters this data differently):

nickname is user@host * "a fancy saying"
nickname on #somechannel
nickname using someserver@somenetwork "a fancy saying"
nickname End of /WHOIS list.

The first line is what we are concerned with. See the user@host part? the host section (whatever is after @) is where you are going to DCC to. You'll want to use whatever port they have setup when they enabled their DCC server. To send a file to the user, type:

/dcc send host:port

example: /dcc send cablemodem911.network.com:59 (this is alphanumeric)
example: /dcc send 100.200.300.4:59 (this is numeric)

Note: Either host type is just as efficient as the other. /dcc fserve only works for IP address connections and does not work via IRC.

As a lot of people on IRC promote and share the best they found around on the net, mIRC now offers a unique built-in Fileserver. This Fileserver feature is somewhat of a cross between DCC and FTP. You open the server window to someone, (it's a special DCC chat window), restricting them to a certain directory tree, and they can browse your file listings, change directories, read text files, or get files. This is also effected by the same problems as DCC.
When fserve won't send, check your status window and see if there are any messages. The "Sending filename.ext" message is a default message sent by the file server when it starts to send you a file. The problem with you not receiving the file either means that the fileserver never sent it (But still displayed the text message), or there is a problem on your end.

1. Make sure you don't have the file type on ignore (File > Options > DCC > Folders).
2. Firewall/Network/proxy could be stopping the process.

NOTE: /dcc send -lN is no longer a feature, you can set the max cps in the fserve options dialog (File/options/DCC/Fserve), and then do /dcc send -l and mIRC will limit cps to the max cps.

The syntax to set up a DCC server connection to somebody is:

/fserve [welcome file]

"Max gets" is so that the other person doesn't bring down your machine with too many parallel gets. 4 is probably a reasonable number. The other person will have access to his homedir and all dirs DOWN in the directory tree from that homedir on. "Welcome file" is a text file you can write and specify that will welcome users to your file server. It's optional.

Examples:

/fserve Krejt 3 c:\temp\serve c:\temp\serving\welcome.txt
/fserve Mookies 2 c:\outgoing c:\network\mirc\welcome.txt
/fserve Friend 7 c:\

Typing help in the file server will show the available commands, which are styled after Unix and DOS. "ls" or "dir" will show a directory listing, for example. Even switched commands like "ls -k" (show file sizes in kilobytes) and "dir /w" (show a wide directory listing) work. The server supports all normal ftp commands like cd [dir] , cd.., dir, ls, get, .... but NOT put, hash, upload etc. There is no possibility to delete files in a server connection. Safety risks are none or minimal due to the major restricting of available commands.

Of course, the /fserve command can be used in your Remote section....

Set up a simple Tools/Remote/command like :

"CTCP *:server:?:/fserve $nick 3 c:\temp\serve"

Set the commands to active (/remote on) and off you go....

Other people only have to type "/ctcp yournick server" to activate the server. You can't set up a server to your own mIRC, so others have to test your server. In the directory c:\temp\serve, you place all files other people are allowed to get from you. The people using your server will have access to the c:\temp\serve directory AND ALL directories BELOW it.. like c:\temp\serve\games.

NEVER NEVER NEVER accept a DCC chat or file send from someone you do not know or trust!!! This is the cause of 95% of all IRC security problems. In the mIRC DCC options section, set DCC Chat and Send to IGNORE ALL. Never have the Auto Get option checked.

In short; Trojan horse attacks are attractively disguised files that you download and run, resulting in harmful and dangerous consequences ranging from takeover of your IRC channels, erasing of your hard disk, theft of your account passwords, etc. These (Trojan) viruses are not mIRC or IRC specific, they just spread like fire on IRC.

Trojans are typically files with suffices like "ini", "exe", or "com", such as "dmsetup.exe" or "script.ini". These days nearly all trojans are spread in the guise of a free game, handy tool or other software. You probably downloaded one from a WWW or FTP archive, ICQ file exchange, or through IRC's DCC file transfer (by manual /dcc get or, even worse, an "auto DCC get" feature which allows anybody to send you anything, including not only trojans but also other viruses, child porn, etc).

Typically the Trojan needs to be run manually at first (by you), and then installs hacked files all over your disk silently. There are many different versions of those files, but almost all of them interfere with your mIRC placing backdoors in scripts. The files then auto-send themselves (using an 'ON JOIN' event) to everyone who joins the same channel as an infected user without the users knowledge.

At http://www.irchelp.org/ and at http://www.nohack.net/ you will find detailed instructions and information on all kinds of problems you may encounter on IRC. At this site the best help for problems like this is concentrated and organised by people who are on IRC 24/7, in the Help channels and alike. Read http://www.irchelp.org/irchelp/security/trojan.html to learn all about the virusses on IRC, mostly called Worms or Trojans, that might tackle you.

Prevention
NEVER download files from people or sites which you aren't 100% sure about. Never use the "auto DCC get" feature, and always scan your DCC gets with a decent virus scanner. Note that mIRC by default does NOT accept files from strangers. This has never been otherwise either. If you accepted files by the "auto DCC get" feature in mIRC, you have switched this option ON yourself, really. Do not, never ever, accept anything you have not requested. Do not accept anything from someone you don't know, no matter how attractively packaged.

Removal
Removal of script.ini, dmsetup.exe, and other trojans is a difficult subject. The many variations of the files have different removal techniques. http://www.irchelp.org/ and http://www.nohack.net/ are great information resources for removing these worms. Research all information resources before trying to remove the worms to help determine the best removal techniques.