ALERT: super fast spreading spyware
 

if you recieve any msgs on aim like this one"check this out: http;//www,wgutv,com/osama_capture.php?7HRf"

dont go to it... it installs some spyware and then starts sending the message out to people on your buddy list...

its not too hard to uninstall if you do get it... just go to the new folders it makes in your programs menu and uninstall... and run spybot or ad aware just to be safe...

meanspleen edit: I deliberately broke the link so that no one accidentally clicks on it

Yeah, my friend got it. She's already uninstalled it, but you're right, it hit the Internet like a wildfire.

-Lasereth

you shoulda seen how fast it spread thru the dorms.... all of a sudden everyone was out in the hall... "wtf are you getting those messages from me???"

Heh..thanks for the heads up. My online friend just recently IMed me saying to watch out for an "Osama Captured" IM because it is spyware and that his friend was already infected.
I also usually ignore IMs that usually say something to the effect of "CHECK THIS OUT" or "LOOK I FOUND YOUR PICTURE ONLINE!!" because I usually suspect it's spyware.

*hugs Firefox*

Thanks for the warning. My girlfriend got it earlier this evening, what a pain in the ass.

*Hugs his Linux box* :D

Bah, crap like this annoys me. Gotta love people trying to make a quick buck...

I need to know the name of this bug. Anyone have a name?

http://story.news.yahoo.com/news?tmp...pcworld/114745

theres an article about it

Thanks for the heads-up. I'm sure I'll see the issue at work...

Wow I actually got that AIM msg but didn't know it was this spyware worm! I wouldn't have installed whatever it wanted me to anyway, since it was supposed to be some version of Realplayer (Real Alternative instead) an I use Mozilla, so the scripting on their site obviously didn't work. How lame

what folders does it create? what's the names to remove? I've not seen it yet, but other friends have it and I cannot help them remove it since I cannot see it remotely.

Yeah, A buddy of mine got one of those today. I trust him, and might have normally just clicked the link to see what he was sending me... but the fact that the IM came BEFORE my AIM even finished starting up scared me away. good thing, too.

Heh, my roommate got it. He sent it once to me legitimately and then the game sent another message to me. Seeing the two in a row tipped me off it was a virus plus I read the terms and conditions.

makes a buddylink folder in program files... i think thats it... there may be some registry entries or other files that im not aware of... but that was the main one i saw... and it puts a program group in the start menu

According to what' I've read & seen, the AIM messages send out a broadcast to your entire buddy list, inviting them to download some Osama game. When the user downloads the game, the Buddylinks program is piggybacked on the software, which then sends a message to their buddy list, and so on and so on.

Here's a good look at the Buddylinks program installation specs:
http://us.mcafee.com/virusInfo/defau...virus_k=101007
Should also include removal tools, but if it doesn't, here's AIM's official what to do:
http://www.aim.com/help_faq/security/trojan.adp

BTW, the links all seem to come from the wugtv domain, if your an admin, might want to redirect that to localhost for a while.

lots of users have been calling in with similar problems.....
so i can guarantee it's not just going around on aim, but i don't have all the details...