Choke is one of the few worms to spread via Instant Messenger services--in this case, MSN Messenger. W32.Choke requires users to be running MSN Messenger, and will spread to other users who chat with an infected user. Choke, which appears to have a grudge against President Bush, is not considered a major threat by antivirus companies. Because the worm does not spread via e-mail or damage files on the infected system, Choke ranks as a 2 on the ZDNet Virus Meter.

How it works
Choke arrives via MSN Messenger with the following message:

Message: President bush shooter is game that allows you to shoot Bush balzz hahaha

Attached file: (one of the following)

ShootPresidentBUSH.exe
Choke.exe
(user's name).exe
Hotmail.exe

[an error occurred while processing this directive]

(user's name).exe
Hotmail.exe

If the user opens the attached file, Choke copies itself to C:Choke.exe then sets a Registry key so that the program is run every time Windows is started. The next time Windows is started, Choke will display two dialog boxes. The first says "This program needs Flash 6.5 to run!" Once you click OK, a second dialog box appears displaying this message: "Cannot run program!, Quitting." Choke creates a text file in the root drive with the following information:

Choke , Copyright ® 1886 ... A MAD CHRISTIAN
---------------------------------------
Go talk swearwords about God
You all will die, stupid humans.
You fools didn't see what you have done
Bye slut, go talk shit about me.
(Call me a 'psychophatt', but I respect
the Creator of life...)
' Consider your earth '

Once Choke has infected your system, the worm will spread to any user you chat with.

1 2	| Next page

[an error occurred while processing this directive]