Weird AIM thing

[GoldenEagle]

Apparently somone has hacked into my account or I have a virus that is sending out stuff ony my buddy list. So if you are on my buddy list and you get a link from me I would not reccomend clicking it. My AIM crahsed earlier becuase of something called idemon.dll. Does anyone know any details or had something similar happen to them?

[MrBug708]

Tim's possessed

[Chubby]

i wonder if thats the virus i heard about... check hxxp://www.imchaos.com and see if what they warn against is what is happening to you.

[SirFozzie]

This must be very new. Nothing on Google for either the link or the file..

[SirFozzie]

Do NOT click on links that say something like "whoaa look at what i found click here" or "I can't believe I found %n's Picture"

There appears to be a new virus/worm/spyware that is spreading via AIM profile links.

Apparently, malicious code is being placed on computer systems when victims visit either realphx.com or talkstocks.net (there may also be other domains).

This code is executed either when a visitor OKs at the prompt or automatically if the visitor has not patched Internet Explorer for known vulnerabilities (see Windows Update to patch your system).

Once the victim has been infected, their AIM profile will be changed to reflect only a link to one of the above mentioned sites with the text description as "Whoaa...look at what I found, click here" (there may also be other text descriptions). If the victim attempts to reset their profile, the link will reappear after a reboot or restart of AIM.

Due to variations of the virus/worm/spyware it may take a little work to completely clean it from your system.

Below are some links to removal tools we found (but did not test) followed by some manual instructions that were posted on other sites:

Removal tools
http://j.wftp.org
http://digitalmatter.net/index.php
http://rcc.bgsu.edu/faq/FixMessageTrojans.htm

Manual Removal Instructions
http://www.ncsu.edu/resnet/pages/security/realphx.php
http://j.wftp.org

[GoldenEagle]

I thought maybe I left my AIM up in the computer lab but when back over there and was not signed in anywhere. Hopefully that will solve the problem.

[cincyreds]

It is a virus for sure.

[mtaystl03]

This is a new one. It says "Check this out" and has a link to something about Sadaam or Osama or something. Just dont click on it.

[GoldenEagle]

and if you do click it?

[Chubby]

Originally Posted by GoldenEagle

and if you do click it?

you'll be...


DOOMED!!!

[finkenst]

Originally Posted by MrBug708

Tim's possessed

i beg to differ... I am not possessed...

[Ramzavail]

I just accepted it (the opening of the website) , but I didnt download the player - do I have a virus now?

[Chubby]

Originally Posted by Ramzavail

I just accepted it (the opening of the website) , but I didnt download the player - do I have a virus now?

mmmmm that's a possibility... is your profile changed?

[GoldenEagle]

Man this is pissing me off

[GoldenEagle]

Are there any free virus scans out there?

[Chubby]

Originally Posted by GoldenEagle

Are there any free virus scans out there?

i know there is but I can't remember the site names (had to do one for my dad's computer) try a google search for free virus scan and you should turn something up.

[FrogMan]

I think you can scan for free off of the symantec website...

FM

[FrogMan]

it's on trendmicro's site...

http://housecall.trendmicro.com/

FM

[JeeberD]

Originally Posted by GoldenEagle

Apparently somone has hacked into my account or I have a virus that is sending out stuff ony my buddy list. So if you are on my buddy list and you get a link from me I would not reccomend clicking it. My AIM crahsed earlier becuase of something called idemon.dll. Does anyone know any details or had something similar happen to them?

You just tried to send it to me....

[JeeberD]

Dola-

I just found this on another board. Hopefully it will help you, GE...

i think i found a solution to this osama virus thingy:

go to your control panel settings (which you can access through the start menu) and click on "Add or Remove Programs". from there, scroll through your list or programs until you come across a program called "buddylinks.net messenging integration" or something like that, and remove it.

if you're already on AIM, it might sign you off and your computer may freeze up for about a sec. after that, manually delete the "buddylinks.net" file folder from your "Program Files" folder. also, delete it from your start menu as well.

hopefully, that should do the trick. but just to be on the safe side, it might help to get ad-aware here. hope that helps.

[GoldenEagle]

I downloaded AVG and it syas I have Trojan back door file. The buddy links is alo on my computer. The annoying thing about AVG is it keeps hitting me with a system info dialog.

[GoldenEagle]

I think I have ridden myself of it.