[JustPeachy]

I just got a really strange virus on MSN...I was just chatting with my friend, and messages that said"I took a picture yesterday, want to see it" started coming up over and over again like crazy. Not realizing it was not even a picture file (it was .exe) I accepted the file transfer. Now whenever I talk to people on the messenger, it does the same thing to them because I now have the virus. I have located the file in my Messenger Service received files, and it won't let me delete it. It says that either the file is in use or it is write protected. I have tried everything I can think of to get rid of it, but nothing has worked. Please Please let me know if you know of what I should do!

[eddie5659]

Hiya and welcome

First off, do you know the name of the virus? Rub your uptodate AV and post what you get. Also, try going here and running an online test if you have no AV.

http://housecall.antivirus.com/housecall/start_corp.asp

Plus, go here and download Startup Log. Run the .com which will open up as a DOS window. let it finish and copy the log file and paste it here.

http://home.earthlink.net/~rmbox/Reticulated/Toys.html

Regards

eddie

[JustPeachy]

Thanks Eddie!
I found out what the virus is called, I used McAffee virus scan to find it, and it is called 'W32/Choke.b.worm'. I was thinking that I could clean it out using McAffee, but in order to do so you have to subscribe and pay $25.00. Do you know of any place to go where you can clean out viruses for free?

[tpb]

Go here:
http://housecall.antivirus.com/housecall/start_corp.asp
Run a scan and let housecall clean it.

Once finished scanning go here and follow the regedit instructions:
http://www.antivirus.com/vinfo/virus...e=TROJ_CHOKE.A

[JustPeachy]

Thanks for your help!
I ran the scan, and it will not let me clean and delete the file because it says the file is in use. It is supposed to only be an MSN messenger virus, and I close down the messenger before I try to delete it, so I don't know how I'm going to delete it...Also, on the 2nd link you gave me, am I supposed to only do those steps if I have finished cleaning/deleting the file? Thanks for giving me those links

[eddie5659]

Hiya

I'm not wanting to contradict tpb, but you say you have Choke.b.worm, and when I did a search, the only thing that is choke b is http://www.us.sophos.com/virusinfo/a...w32jerrym.html

Either, they both say about MSN mesenger. Also, this one says:

It also creates a folder called C:\Messenger1324\Brain. The worm puts a file called 1ReadMe.txt, which contains removal instructions, into this folder

Might need further confirmation about which one it is from someone.

Regards

eddie

[Rollin' Rog]

These instructions should apply to the Choke.b worm:

http://www.sarc.com/avcenter/venc/da...ying.worm.html

These are for choke.a

http://www.symantec.com/avcenter/ven...hoke.worm.html

It does really appear as if you have the first one though.

You should do the registry deletion first, then after rebooting you should be able to delete the infected file as it will not be running.

[yobob]

Hi, my son downloaded a virus off MSN and i checked and it was from this message

"Heeey! I saw a picture online and im definately sure its you , the one on the left rite?? http://www.modelosunica.com/picdata/39ak4f2/picture_dl.php"

Now MSN freezes and my mouse freezes...I'm thinking the virus is similiar to the one mentioned, but nothing is working...Please help!

[bellejngoi]

i don't know if this is similar or not but the virus i received was a 24 KB zip file named "photo album." i have no idea how to delete this. Can you help?

thank you.


---
(-: