BAT911.Worm - Removal

Risk Level 2: Low

Printer Friendly Page

Discovered: March 31, 2000
Updated: February 13, 2007 11:51:02 AM
Also Known As: BAT.Chode.Worm, Chode, Foreskin, BAT911, 911 Worm, W95.Firkin, Worm.Firkin, BAT/Firkin.Worm
Type: Worm
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP


To remove BAT911.Worm from a computer that is already infected, please follow these steps:

CAUTION: The following instructions have you delete a folder and three files from your computer. Make sure that you select and delete only the folder and files that are specified.
  1. Run LiveUpdate to make sure that you have the most recent virus definitions.
  2. Using Windows Explorer, delete the following folder:

    C:\Program Files\Chode
  3. Delete the following files:

    C:\WINDOWS\Start Menu\Programs\StartUp\Ashield.pif
    C:\WINDOWS\Start Menu\Programs\StartUp\Netstat.pif
    C:\WINDOWS\Start Menu\Programs\StartUp\Winsock.vbs
  4. Run a full system scan.


Writeup By: Raul Elnitiarta
Search by name
Example: W32.Beagle.AG@mm
Limited Time Offers! Save up to 50%
Windows Vista Security