erich musick's blog

Personal blog of Erich Musick - student, programmer, web designer, and Christ follower.

AIM "Photos from 6th grade" Virus

Posted On: May 29th, 2006 at 10:31 pm

I got called out on an emergency virus removal shortly after waking up this morning at 11:15. It turned out that my client was plagued with one of those viruses that spreads around on AIM. AVG Antivirus identified it as downloader.generic.hgt. I struggled with removing it for a few hours and then came across a few utilities that got rid of everything for good. Below, I've summarized the steps to remove this trojan that I found on the Tech Support Guy forums.

Download and run AimFix.
Download AlcanShorty to your desktop and run it.
Running AlcanShorty will create a folder on your desktop called alcanshorty_en. Double click this, locate run.bat and double-click it.
Run.bat will download an executable called BFU and a script to be run with it. This will download a file called BFU.exe and a BFU script. If your firewall asks for the download application to connect to the internet, allow access. When you receive a message that Alcan Shorty is done, exit the console window.
In the alcanshorty_en folder, double click BFU.exe.
Click the open folder icon. Navigate to the alcanshorty_en folder and select alcanshorty.bfu.
Click Execute
When this is done, download and run the Look2Me destroyer.
Check the box labeled "run this program as a task."
Wait for the application to close and reopen. Once it reopens, click the button labeled, "Scan for L2M."
When the scan is complete, click the button labeled, "Remove L2M. Let the application restart the computer if it asks to.

You should be all set.

Back to AIM "Photos from 6th grade" Virus