This covers the 5th variant of dmsetup.exe, the mIRC Trojan Horse attack. For more information, including a list of symptoms for these attacks, please see the main Trojan help page: trojan

This is a serious attack that creates a really large number of junk files and folders. While we usually discourage people from downloading a “magic bullet” executable fix for trojans, since downloading stuff blindly is how you got in this mess in the first place, it really makes the most sense to do so in this particular case. At least this particular solution, offered courtesy of #NoHack on DALnet, is a “.bat” or batch file, which is an executable text file. You can and should examine it with Notepad to verify that there aren’t any other nasties hiding inside.

Download the following file and run it. Follow its directions carefully. Don’t forget about the part at the end where it tells you to edit your autoexec.bat file. If you don’t do that, you’ll still be infected. If you’re sure that you have dmsetup 5 and after running this fix you are still infected, then most likely you have a different variant of the attack that is not covered by this fix. If that is the case, you are left with no other choice but to do a clean re-installation of your system, as we described on our main Trojan page.

After reading the directions above, download: dm5clean2b.bat

Thanks again to #NoHack on DALnet for providing this fix.

Return to main Trojan page.