June 19, 2001
As if understanding viruses, worms, and Trojans weren't difficult enough, the often accompanying misinformation makes the job much harder for many users. A savvy reader reported a hoax that provides misleading guidance to users affected with the MSN Messenger Choke worm. The erroneous warning stated in part, "you must delete all winzip files before you can delete the virus from the computer." As with most such hoaxes, the message ended with the defining statement of nearly all hoaxes: "Please pass this on to n e one else you know..."
In fact, the Choke worm arrives via MSN Messenger as an .EXE file, it has no impact on ZIP files nor would deleting all ZIP files have any impact on the worm. As is nearly always the case, the absolute best method of ridding yourself of this worm is to use updated antivirus software to cleanly remove it from your system.
The Choke worm is believed to have originated in the Netherlands around June 6, 2001. If you don't use MSN Messenger, the worm cannot spread (though it can still install itself). The filename may be any one of the following: ShootPresidentBUSH.exe, Choke.exe, Hotmail.exe, or a filename using the sender's name with an .exe extension. In short, ANY .exe file received via MSN Messenger should be considered infected until proven otherwise. When this particular worm sends itself out, it does so with the following text in the message:
President bush shooter is game that allows you to shoot Bush balzz hahaha
The worm has no malicious payload, it just propagates itself to others via the MSN Messenger service.
Depending on the antivirus vendor, Choke is also known as Psychopatt and is the second worm to spread via Microsoft's MSN Messenger program. The first such worm was discovered on April 23, 2001 and was sent as an attachment named Hello.exe. The text of that message is:
i have a file for u. its real funny
The Hello worm is also referred to as the FunnyFiles.Worm
