"B1ld0" AIM Virus Removal
There is a new AIM profile virus, with the text:
"an0th3r pr0fil3 0wN3d By b1Ld0"
Jay has finally gotten around to finishing the removal tool. Get it HERE
To manually remove the virus:
1) Press CTRL ALT DEL (CTRL SHIFT ESC if you are on XP or 2000) to open the "task manager" in windows.
2)Look for a process called "snd332" (if you are on XP or 2000, it will be under the processes tab, and will be called snd332.exe) NOTE: there may be more than one instance...please look carefully.
3) Select the snd332/snd332.exe process, and then click "end task" on the task manager. This will close down the virus file from running.
4) Now you will need to search through the hard drive for the file "snd332.exe". This file would be hidden, and will require you to enable viewing of hidden files and folders.
To do this, click on the Tools menu in Explorer, then click Folder Options, and go to the View tab. (if you are on 98 this will be in the View menu) Now check the box next to "show hidden files and folders" and uncheck the "Hide protected operating system files" box. Now choose "apply to all folders" and click apply.
The file is usually located in C:\Windows\System or C:\Windows\System32, though it varies on computer to computer.
7) Finally, do not forget to remove the link from your profile.
Note: The creator of this worm has contacted Jay and asked that a disclaimer be added to this page stating that the "B1ld0" worm does not adversely affect a computer outside of Instant Messenger profiles, and does not install spyware or adware. It was unintentionally leaked into the wild, and was not meant as a malicious action.
You can contact the author of the B1ld0 worm for removal help on AIM at Billy04x or via e-mail at hdgone@mchsi.com
LEGAL STUFF: I am not affiliated with the makers of this virus in any way, nor am I affiliated with any anti-virus company. I merely provide this as a service for those who have been infected. I take no responsibility for any damage done by the virus or by those incorrectly following these removal steps, or those using my removal tools.
