How to Remove MSN Virus Project 1/ Generic2.EXO / Backdoor.Generic3.SAT
This MSN virus is a new virus which spreads via MSN Messenger. Once a computer is infected it will send copies of itself to every online contact on the infected users contact list.
A new MSN Virus removal tool has been created. It is recommend you try this first by downloading and running this before trying the instructions below. You can download the tool HERE. Please let us know if it worked for you so we can keep improving our products.
The message says (or similar to):
“is that u on that photo http://lollypics.xx.funpic.org/pictures.php?photo656.jpg†(link edited to prevent people getting further infected)
Other links may include:http://www.picture-database99.com
Once clicked, it will open Internet Explorer and prompt you to download a file called photo656.pif or another file with a similar name (note: it is now a .pif file being downloaded, not a .jpg). Once run, the computer will be infected.
This virus also installs a toolbar into Internet Explorer called “Toolbar888â€Â.
AVG Antivirus Detects this threat as:
- Trojan horse Generic2.EXO
- Trojan horse BackDoor.Generic3.SAT
How to Remove MSN Virus Project 1/ Generic2.EXO / Backdoor.Generic3.SAT:
Goto: Start > Control Panel > Add/Remove Programs.
Find Toolbar888 and click the “Change/Remove†button to uninstall it
Press CTRL+ALT+DELETE all at the same time so you are viewing the “Process†Tab.
If you find any (or all) of the following (don’t worry if you cant find all of them):
Update.exe
goll.exe
loadadv455.exe
drsmartload.exe
goll.exe
two.exe
vcncr.exe
rorjxk.exe
eyewblbby.exe
cgqrvrva.exe
Highlight the name and click the button “End Process†to each of the above you find in the list.
Find and Delete The Following Folders and their Contents:
C:\Program Files\Common Files\{28676FB5-0AE9-3081-1205-03030930003d}\
C:\Program Files\Common Files\{38676FB5-0AE9-3081-1205-03030930003d}\
Find and Delete the Following Files with the Folder (NOT the folder itself):
In the folder: C:\Windows\system32\ (don’t worry if you cant find all of them)
Find and Delete:
goll.exe
drv.exe
loadadv455.exe
one.exe
two.exe
In the folder: C:\Documents and Settings\[current user](replace [current user] with the name you are currently logged on as, don’t worry if you cant find all of them)
Find and Delete:
goll.exe
drv.exe
loadadv455.exe
one.exe
two.exe
In the folder: C:\ (main level of C drive, be careful here, don’t worry if you cant find all of them)
Find and Delete:
goll.exe
drv.exe
loadadv455.exe
one.exe
two.exe
drsmartload.exe
Update your Antivirus with the most current virus definitions and run a full system scan to clean up any remaining files. If you do not have any antivirus software. AVG Free is a great option.
You may need to reinstall MSN Messenger again.
Showing posts with label Messenger Virus Removal. Show all posts
Showing posts with label Messenger Virus Removal. Show all posts
December 17, 2008
W32.Aplore@mm
How to Remove the MSN Messenger Virus W32.Aplore@mm
W32.Aplore@mm is a MSN Messenger Virus which spreads by sending links to an infected web page. When a user is infected with this virus they send a message do their online contacts. The message may be as follows where ZZZ is the contacts name, the A's repersent an IP address and the B's repersent a port number.
ZZZ says:
this is cool, http://AAA.AAA.AA.AA:BBBB
ORZZZ says:
btw, download this, http://AA.AA.AAA.AAA:BBBB
To remove the virus is simple to do. Simply follow these instructions:
1. Close Messenger. This will simply stop any more of your contacts getting the virus.
2. Goto 'Start' then 'Run' and type 'msconfig'. A new window should appear.
3. Click on the tab at the top right that says 'Startup'.
4. Unitick the box next to "Explorer".
5. Restart you Computer.
The virus has now been deactivated!
W32.Aplore@mm is a MSN Messenger Virus which spreads by sending links to an infected web page. When a user is infected with this virus they send a message do their online contacts. The message may be as follows where ZZZ is the contacts name, the A's repersent an IP address and the B's repersent a port number.
ZZZ says:
this is cool, http://AAA.AAA.AA.AA:BBBB
ORZZZ says:
btw, download this, http://AA.AA.AAA.AAA:BBBB
To remove the virus is simple to do. Simply follow these instructions:
1. Close Messenger. This will simply stop any more of your contacts getting the virus.
2. Goto 'Start' then 'Run' and type 'msconfig'. A new window should appear.
3. Click on the tab at the top right that says 'Startup'.
4. Unitick the box next to "Explorer".
5. Restart you Computer.
The virus has now been deactivated!
Choke.exe aka I-Worm.Choke
How to Remove the MSN Messenger Virus Choke.exe aka I-Worm.Choke
Even if the user accepts the download he or she will not be infected. The user must download and run the files they received. The file name can differ every time. It can be 'ShootPresidentBUSH.exe', 'Choke.exe' or '%The user name%.exe' where the user name is a nickname from dalist.txt.
To remove the virus is simple to do. Simply follow these instructions:
1. Press Ctrl+Alt+Delete and select Choke.exe, and press "End Task".
2. Close Messenger. This will simply stop any of your contacts getting the virus.
3. Goto 'Start' then 'Run' and type 'msconfig'. A new window should appear.
4. Click on the tab at the top right that says 'Startup'.
5. Unitick the box next to "Choke.exe" or simlar name.
The virus has now been deactivated!
To remove it fully follow these instructions:
1. Goto 'Start', then 'Find' and search for "Choke.exe".
2. Click on the file and press 'Delete'.
3. Empty your recycle bin.
The virus has now been fully removed!
Even if the user accepts the download he or she will not be infected. The user must download and run the files they received. The file name can differ every time. It can be 'ShootPresidentBUSH.exe', 'Choke.exe' or '%The user name%.exe' where the user name is a nickname from dalist.txt.
To remove the virus is simple to do. Simply follow these instructions:
1. Press Ctrl+Alt+Delete and select Choke.exe, and press "End Task".
2. Close Messenger. This will simply stop any of your contacts getting the virus.
3. Goto 'Start' then 'Run' and type 'msconfig'. A new window should appear.
4. Click on the tab at the top right that says 'Startup'.
5. Unitick the box next to "Choke.exe" or simlar name.
The virus has now been deactivated!
To remove it fully follow these instructions:
1. Goto 'Start', then 'Find' and search for "Choke.exe".
2. Click on the file and press 'Delete'.
3. Empty your recycle bin.
The virus has now been fully removed!
PIC1234(1)(1)(1)(1)(1).exe
How to Remove the MSN Messenger Virus PIC1234(1)(1)(1)(1)(1).exe
To remove the virus is simple to do. Simply follow these instructions:
1. Close Messenger. This will simply stop any of your contacts getting the virus.
2. Goto 'Start' then 'Run' and type 'msconfig'. A new window should appear.
3. Click on the tab at the top right that says 'Startup'.
4. Untick the box next to 'MSN Messenger'.
5. Click 'ok' and when it asks if you want to restart your computer say no.
6. Press 'Ctr' + 'Alt' + 'Del'. Find the file that says 'MsgSpread' and click End Task.
The virus has now been deactivated!
To remove it fully follow these instructions:
1. Goto the Desktop and open My Documents.
2. Double click on 'Messenger Service Received Files'. If you dont see a folder called that then goto 'My Computer' then goto 'C' then 'Program Files' and finally 'Messenger Service Received Files'.
3. You should now see a file called 'PIC1234(1)(1)(1)(1)(1)(1)(1)(1).exe'.
4. Click on it ONCE and press 'Delete'. This should delete the file.
5. Empty your Recylce Bin.
The virus has now been fully removed!
To remove the virus is simple to do. Simply follow these instructions:
1. Close Messenger. This will simply stop any of your contacts getting the virus.
2. Goto 'Start' then 'Run' and type 'msconfig'. A new window should appear.
3. Click on the tab at the top right that says 'Startup'.
4. Untick the box next to 'MSN Messenger'.
5. Click 'ok' and when it asks if you want to restart your computer say no.
6. Press 'Ctr' + 'Alt' + 'Del'. Find the file that says 'MsgSpread' and click End Task.
The virus has now been deactivated!
To remove it fully follow these instructions:
1. Goto the Desktop and open My Documents.
2. Double click on 'Messenger Service Received Files'. If you dont see a folder called that then goto 'My Computer' then goto 'C' then 'Program Files' and finally 'Messenger Service Received Files'.
3. You should now see a file called 'PIC1234(1)(1)(1)(1)(1)(1)(1)(1).exe'.
4. Click on it ONCE and press 'Delete'. This should delete the file.
5. Empty your Recylce Bin.
The virus has now been fully removed!
cute.pif - W32.Kelvir.A
How to Remove the MSN Messenger Virus cute.pif - W32.Kelvir.A
Once again another MSN Messenger Virus is spreading around the Internet. This time the virus sends the following message to all your contacts:
omg this is funny![Followed by a link to download the cute.pif from jose.rivera4.home.att.net]
The user then downloads the file which sends the link to all of their contacts and then downloads a W32.Spybot worm onto the infected machine.
If your are lucky enough the program will just run on your machine, send to your contacts and end without downloading the Worm as it did on the machines we tested cute.pif on.
The first thing you should do therefore is delete the downloaded cute.pif making sure you do not run it again! Then check to see if a Worm has been downloaded as well.
1. Press Ctrl+Alt+Delete and look for hotkeysvc. If it's there select it and press "End Task".
2. Use the Windows Find feature to look for a file called "hotkeysvc.exe". Which if their should be in the %System% directroy. If you find the file delete it.
3. Goto 'Start' then 'Run' and type 'msconfig'. A new window should appear.
4. Click on the tab at the top right that says 'Startup'.
5. Look for, and if it exists, unitick the box next to "hotkeysvc.exe" or simlar name.
The http://jose.rivera4.home.att.net/cute.pif has now been fully removed!
Once again another MSN Messenger Virus is spreading around the Internet. This time the virus sends the following message to all your contacts:
omg this is funny![Followed by a link to download the cute.pif from jose.rivera4.home.att.net]
The user then downloads the file which sends the link to all of their contacts and then downloads a W32.Spybot worm onto the infected machine.
If your are lucky enough the program will just run on your machine, send to your contacts and end without downloading the Worm as it did on the machines we tested cute.pif on.
The first thing you should do therefore is delete the downloaded cute.pif making sure you do not run it again! Then check to see if a Worm has been downloaded as well.
1. Press Ctrl+Alt+Delete and look for hotkeysvc. If it's there select it and press "End Task".
2. Use the Windows Find feature to look for a file called "hotkeysvc.exe". Which if their should be in the %System% directroy. If you find the file delete it.
3. Goto 'Start' then 'Run' and type 'msconfig'. A new window should appear.
4. Click on the tab at the top right that says 'Startup'.
5. Look for, and if it exists, unitick the box next to "hotkeysvc.exe" or simlar name.
The http://jose.rivera4.home.att.net/cute.pif has now been fully removed!
IM-Names Virus
How to Remove the MSN Messenger Virus IM-Names virus
1. Close Messenger.
2. Goto 'Start' then 'Run' and type 'msconfig'. A new window should appear.
3. Click on the tab at the top right that says 'Startup'.
4. Untick the box next to 'IM-Names'. (If you cannot find it skip this task)
5. Click 'ok' and when it asks if you want to restart your computer say no.
6. Press 'Ctr' + 'Alt' + 'Del'. Find the processthat says 'IM-Names' and click End Task.
The virus has now been deactivated!
To remove it fully follow these instructions:
1. Search your computer for all files called "IM-Names".
2. Delete all files that it finds.
3. Empty your Recylce Bin.
The virus has now been fully removed!
Subscribe to:
Posts (Atom)
Posts
