Tom's Guide | Tom's Hardware | Tom's Games
![]() |
![]() |
![]() |
hello. i appear to hav a virus that affects msn messenger. without me knowing it asks the other person to whom im speaking the question 'hey want to see my new pic?' and then says 'ok cool'. it then tries to send itself to the other person. i am not aware of any of this but everyonre i talk to tells me about it. any ideas on how to be rid of it?

The same happens to me aswell. also im in the middle of a conversation and the kryptonice ghost virus comes up and infects there computer with it. when i don't know its going on. anyone know why. -Trojan maybe??

MSN Messenger users are again the victims of a chat application worm. Known by a few different names--Troj_Brain.A, W32.Choke.b, W32.NewPic, Worm.JerryMsg--this MSN Messenger worm will infect anyone contacting an infected PC by asking if the user wants to see a new picture. If the correspondent says Yes, the worm then sends a copy itself via MSN Messenger. If chat application other than MSN Messenger is used to contact the infected PC, the worm might install on the new PC but it will not spread to others. MSN Messenger users were victims in June of the tasteless Choke worm. This latest MSN Messenger worm is not destructive, and even contains its own removal instructions. Because of its limited infection capabilities and relative harmlessness, this MSN Messenger worm only ranks as a 2 on the ZDNet meter.
How it works
The worm arrives via MSN Messenger as a file called PIC1324.exe. If executed, the worm then displays an Error message box on the infected computer with the following text:"Cannot open file. May be corupted. Replace the file with a new one and try again".
The worm then installs itself to run every time the computer is booted. The worm appears in the task manager as MsgSprd. The worm monitors chats on MSN Messenger and will attempt to engage anyone who contacts the infected computer with the following exchange:
hey, want me to send my new pic? i took it yesterday
Depending on the response, the worm will send the file with the following text:
User Worm
send there
sure [no response]
maybe pweese ? :-)
i guess i hope you like it
ok alright, here ya go
yea alright, here ya go
yes alright, here ya goThe worm does no damage and its own removal instructions can be found in a file located at C:Messenger1324Brain1Read Me.txt. The text file reads:
I come in piece. My name is Jerry. The purpose of me is to spread. I'm not annoying, nor dangerous.
How to remove me:
1) Click Start, select Run. The Run dialog box pops up.2) Type: msconfig The System Configuration Utility pops up.
3) Click the Startup tab at the top. In the list, find MsgSprd, Messenger, or pic1324, uncheck, press Apply, then press Ok.
4) Restart your computer Or press Ctrl - Alt - Del, select MsgSprd from the list, then press End Task.
You may freely delete the files or the 'C:Messenger1324' directory.

For the kryptonic ghost message, go back to the Virus and Security message board and scroll down a bit. Depending on when you get this message, it may even be on page 2.

hey im infected:( with kryptonic ghost ive found out that the file has been sent to my system files under the name 'Mtr2' and i cant delete it:( coz it seez "cannot delete this file is being used by windows" can u plz tell me how to get rid of it
Thanx,
Devastat|0nX

![]() |
![]() |
![]() |

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.
| Ads by Google |