(Untitled)

[sport6449]

If you get an IM from me asking you to click on a link, don't do it. It's a virus. It got me.

I'm working on debugging it. More later.

Comments

[gameshowman]

I clicked it, and it came REAL close to getting me, but I stopped it in time.

[sport6449]

Uh, how? And how do you get rid of it? Anyone?

[gameshowman]

Simple. I didn't let the file download.

[sport6449]

That helps. :-P

Anyone know how to get rid of it if you already have it?

[kevin]

Chuck,

Do you know the name of the virus, or symptoms of what it does (does it redirect you to a website? If so, which site? -- stuff like that)?

[sport6449]

It's something called mysxl.hackit or something like that. What it does is overtake your AIM system after so many minutes and IMs the link to crazypics.com or something and it comes up a link. It downloads a file to your HD then propagates itself through your AIM system. There's now a file called lockx.exe in my C:/Windows/System32 fold that's causing trouble and I can't see to get rid of.

It's actually gotten so bad, somehow it's now affecting my internet connection. I'm at work typing this. If you know how to debug it, please let me know. I tried to delete the mysxl.hackit and it worked but it appears to be in the registry. The lockx.exe file is now the problem. It just won't go away.

[kevin]

This looks like a pretty ugly one.

Here's some info:
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=BKDR_IRCBOT.AV&VSect=T

...and a "solution" from them. It involves rebooting into safe mode and then editing your registry to remove the calls to lockx.exe:
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=BKDR%5FIRCBOT%2EAV&VSect=Sn

If you have not done so, you might be interested in downloading "HijackThis", which is a somewhat-advanced spyware/adware/malware removal tool: http://www.majorgeeks.com/download3155.html

Good luck!