Freaking AIM Viruses...

[Exile69]

ARGH!

I was idly chatting on AIM today with my girlfriend and a few other friends when all the sudden a random IM from her is automatically sent. I clicked on the link because I figured it was nothing bad and something I just "had" to see. Well, apperently this is a pretty common virus going around in which it sends everyone that's online on your buddy list an IM with something random and curious with a link. If you click on the link or maybe even just recieve the IM a .exe file is put on your computer appropriately entitled, "hell". As soon as it fired off on my computer a few minutes later I promply ended it by pressing ctrl-alt-delete -> processes -> end hell.exe. I opened my C: drive folder and, whadya know, there it was. So I deleted that and it apperently found a clever way to reinstall itself. I searched my C: drive and found something in my C:\windows\prefetch folder and deleted that. Seems to be gone now. Now, in the interest of fully removing this little bugger I've heard of 'hacking it out of the registry'. What is a registry, where is it located, and how do I do this?

[SteveI]

The registry can be easily accessed. HOWEVER, if you've never worked with it... be very very careful... One mistake and your system could become unbootable.
.... That said, you can try searching for any references to the culprit, and delete those entries.

You've been warned....

All you have to do is from start, run... type regedit.

[Lazgoat]

Then go out and buy Zone Alarm Internet Security Suite with AIM protection

[skool h8r]

Hi Exile69,
I have a way to remove it possibly. Can you try and find out the names of any processes running that you've not noticed before including the file extension and post them here. Could you also post the full folder path to these processes. One more thing i need is any unusual startup entries you've never noticed before and also post them here. With this information, i can create a batch file that will remove the virus and the files associated with it and 'kill' it from memory. I had the same problem with a similar piece of malware and got rid of it myself, mainly because my AV (AVG 7) didn't pick it up at all!

[madcatmk3]

my friend barry has Sytematic corparte editon. I migh be able to burn it and send it to you (he'll prboly caharge) but you have to promise to destroy it. I'll have to chech with him first.