To remove this worm, end its task to stop it from running,
delete any files detected as W32.Choke.Worm, and undo, if necessary, the change that it made to the registry.
To stop the worm from running:
1. Press Ctrl+Alt+Delete. The Close Program dialog box appears.
2. Select the program registered as Choke, and then click End task.
To delete the worm:
1. Run LiveUpdate to make sure that you have the most recent virus definitions.
2. Start Norton AntiVirus (NAV), and run a full system scan, making sure that NAV is set to scan all files.
3. Delete any files detected as W32.Choke.Worm
To edit the registry:
CAUTION: We strongly recommend that you back up the system registry before making any changes.
Incorrect changes to the registry could result in permanent data loss or corrupted files.
Please make sure you modify only the keys specified.
Please see the document How to back up the Windows registry before proceeding.
This document is available from the Symantec Fax-on-Demand system.
In the U.S. and Canada, call (541) 984-2490, select option 2, and then request document 927002.
1. Click Start, and click Run. The Run dialog box appears.
2. Type regedit and then click OK. The Registry Editor opens.
3. Navigate to the following key:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
4. In the right pane, delete any values that point to either of the following:
C:\Choke.exe
C:\ShootPresidentBUSH.exe
5. Exit the Registry Editor.
