Help --- Virus or what? Win32:Ircbot-CFW [trj]

Viruses and worms
1

I have been recieving “zip” files from someone in MSN chat who I thought was a friend… The message says the file names are something like IMG-0000.zip. when I look at the file info it makes reference to a website www.photoupload.com. Avast says the virus is Win32:Ircbot-CFW [trj]

What is this? What is going on? I had avast delete the files and I think I have cleaned the virus from my HD. I can’t find info on the web about this specific name (Win32:Ircbot-CFW [trj]). I see references to similar filenames that claim these are very dangerous viruses that record the user’s keystrokes and can let the hacker steal passwords and take over my PC.

How do I know that I have gotten rid of this?

2

It will be good if you download, install, update and run AVG Antispyware. Some users recommend SUPERantispyware, Spyware Terminator and/or a-squared (take care about false positives).
If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.

If you still detecting any strange behavior or even you’re sure you’re not clean, maybe it will be good to test your machine with anti-rootkit applications. I suggest AVG, Panda and/or F-Secure BlackLight.

Oh, a deep avast scanning will be good too 8)
Welcome to avast forums.

3

Thank you for the suggestions. I will run the additional scans and hope for the best. I sure would like to avoid having to do a complete reinstall of windows just to be sure I’m clean.

4

It may indicate your friend’s computer is infected. See this, for example

http://www.symantec.com/security_response/writeup.jsp?docid=2007-092015-1223-99&tabid=2

It then checks the compromised computer for the chosen geographical system locale and sends one of the zip files containing the worm to Microsoft instant messaging clients contacts with a message in one of five languages as follows: