there is a quickly spreading virus going around msn right now where you are asked to click on a link to confirm to someone if 'this is you.' well, it's a hoax and puts a virus on your computer. any help with getting rid of it?

Ive never heard of this virus ive heard of similair methods on stuff on MSN Gaming Zone but i havent seen it anywhere else sorry...try doing a virus scan and a system restore maybe

If I remember correctly (which I don't) it is the Kelvir virus. Try http://securityresponse.symantec.com/avcenter/ven....removal.tool.html

that link doesn't work for me. it says the page cannot be displayed. any other ideas?

more info on the virus. it does strange things with the windows i have open. when i want to change my active window to a different one (like when i want to bring a different conversation box to the front so i can read it), it doesn't work by just clicking on a part of the window or clicking on the item in the taskbar at the bottom. instead, i have to minimize the windows that are in front of it one by one. pretty weird...

The link works for me.

quote:

---

Originally posted by Funness
The link works for me.

---

quote:

---

Originally posted by M73A

quote:

---

Originally posted by Funness
The link works for me.

---

ditto

---

quote:

---

Originally posted by alexj35
that link doesn't work for me. it says the page cannot be displayed. any other ideas?

---

his host file must have the website blocked.
http://www.softpedia.com/get/Antivirus/W32KelvirD...Removal-Tool.shtml
that link will direct you to the tool used by Symantec to get rid of the virus, if it is the Kelvir virus

this is going to sound crazy. first of all, i downloaded firefox and tried that first link again. page unavailable. i also tried the latest suggestion to get rid of it. i was able to get to the download site, but every time i clicked download, it brought me to one of 2 pages. when i click the link next to 'free download' here: http://www.softpedia.com/progDownload/WKelvirD-Fr...ownload-20718.html, it brought me to this page: http://www.softpedia.com/get/Antivirus/W32KelvirD...Removal-Tool.shtml, and when i click 'download' on this page, it brings me back to the other! i tried the mirrors and neither of them loaded. both were unavailable. is this the virus that's causing all this mayhem?

quote:

---

Originally posted by alexj35
this is going to sound crazy. first of all, i downloaded firefox and tried that first link again. page unavailable. i also tried the latest suggestion to get rid of it. i was able to get to the download site, but every time i clicked download, it brought me to one of 2 pages. when i click the link next to 'free download' here: http://www.softpedia.com/progDownload/WKelvirD-Fr...ownload-20718.html, it brought me to this page: http://www.softpedia.com/get/Antivirus/W32KelvirD...Removal-Tool.shtml, and when i click 'download' on this page, it brings me back to the other! i tried the mirrors and neither of them loaded. both were unavailable. is this the virus that's causing all this mayhem?

---

Not sure why no one else thought of posting the file.

Direct Link
Download Here

I've had some experience with this virus.  A person sends you a link from a msn messenger site and it has your e-mail address in the URL.  When you click the link it asks you to download something.  I just ignored it.

yeah, that's the thing that makes it so sneaky. in the link is your email address. how bad could it be? apparently, you don't even have to download a file, just opening the browser window is enough, because plenty of my friends got it that way. now i'm going to ask a big favor of somebody. can someone download the remover tool and send me the .exe? alexj35@hotmail.com. i would appreciate that a LOT

Here is the other virus scanner from the link you provided.

Alot of virii stop AV programs from working.

quote:

---

Originally posted by Funness
Alot of virii stop AV programs from working.

---

yes, that conversation window that you showed as the attachment is EXACTLY what the virus does. i see you provided a link to get rid of it, but when i click on it (of course), i get 'web page unavailable.' can somebody download the removal tool and attach it?

Goto C:\WINDOWS\system32\drivers\etc and open "Hosts" with notepad and remove everything in there. You should then beable to goto the site to fix it.

Most people don't have anything usful in the Host file. The commented out section at the top is also usless. Thus, you could just delete everything.

ok guys, this is getting ridiculous. my computer seems to be dying. unbelievable amount of lag going on. i can hardly do anything. i'm in desperation mode now. i found my hosts file and opened it with notepad. here's what i found:

# Copyright 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host
127.0.0.1       localhost


i don't see any web pages or anything in there...

i was going through kevin's list of free online sites to clean up my computer. they weren't working too well, most of em were unavailable. i was able to download bitdefender, though. it started scanning automatically, while i had a different scan going. things were going well when my computer just sort of froze up. and ever since then, i've been having MAJOR issues. i tried uninstalling it and some weird things happened. now it's not on my list of programs but it IS still on my computer. when i go to programs/bitdefender/modify, repair, or uninstall, it starts to do something and then says that it can't modify it because it's not installed. i KNOW it's at least partly installed because it runs at startup! this is so bad... can we save my computer??

i suppose i should try to save as much information as i can before reformatting, eh? i'll lose everything?

well, i was in 'safe mode with networking' and browsing around. it was the only way i could use the computer without unbelievable lag. when i scanned with this site: http://www.klitetools.com/comments.php?id=2088&ca...t=Dr.Web+CureIT%21
it found SOMETHING and i got rid of it. i also did some of the things on this site: http://securityresponse.symantec.com/avcenter/ven...ta/w32.chod.d.html like the things it tells you to do in the registry. i deleted some of the stuff in there. it wasn't all accurate, but i did as much as possible. when i rebooted in normal mode, much to my surprise, things ran smoothly! so i don't know if it's really GONE, but i like the way things are running now. i still can't open the sites that were listed previously. they aren't in my hosts file, so i don't know why i can't go to them. if anyone has any other suggestions on how to unblock those, that'd be great.

anyway, thanks for the help everyone

it's completely empty now, but i still can't open those web pages... should i just say 'oh well'? or is there gonna be a solution that doesn't involve formatting the computer?