AIM Virus

[altotheex13]

I just got a virus from aol instant messenger. It gives my comp a lot of pop-ups even when I'm not online. There are also toolbars that I did not install. I think some of the toolbars and things could be spyware. I am a noob please help me.

[Status]

Sounds like you've got some adware on there.

Download Spybot Search and Destroy to get rid of spyware and adware and such, its my favorite choice.
http://security.kolla.de/

Download AVG to get rid of viruses and trojans, its not flashy or anything but it gets the job done.
http://grisoft.com

Both are free, and you might want to download a firewall incase you've gotten a trojan, and they're always nice to have.

Get the free ZoneAlarm
http://www.zonelabs.com

You should do monthly or even weekly scans for these things to keep your computer clean.

Welcome to AO. :D

[Agent_Steal]

Well you might wanna install and run this program [ If you dont have it already ]:
Ad-aware Standard Edition (http://www.lavasoftusa.com/)
This program will check your computer for spyware.

I read that you said it was a virus ? Now have you scanned your computer with your anti-virus software ? Cause if you did it should display the name of the virus that it has detected. Is your anti-virus software up-to-date as well ?

Another thing what are the name[s] of the toolbar[s] which you are mentioning ?

This might be something that you might wanna check out aswell:
Spyware Guide (http://www.spywareguide.com/)

Contains a lot of information :

The Spyware Guide was created to provide an all inclusive and updated resource on spyware applications, what they do and how they’re used. These resources include: which software applications can detect and defeat spyware, an extensive database of all known spy software and adware applications and contact information as well as other privacy related products.

You might wanna bookmark it you never know could come in-handy someday again.

But like status has said it sounds more like spyware. But you never know it's better to be safe than sorry.

Good luck.

[slick8790]

Get the free ZoneAlarm
http://www.zonelabs.com


NO NO NO! DO NOT GET ZONE ALARM! it is nothing but trouble. for a free firewall, get kerio. better protection, less hassle.


slick

[lord_darkside_x]

the aim virus you are speaking of (as far as i know) is actually classified as a trojan or worm . i am assuming that this is the one you get from clicking the link in a persons profile by clicking on a link that says "look i found %n's picture here" or something like "look at this amazing site" there are three versions of the virus... .one is realphx, one is buddypicture and the other i forget... but if you search google you can find fixes. spybot s & d finds realphx but i don't know about the otheres....

here is a link that provides on fix... that i think works for all three...
http://aim.thespear.net/

[altotheex13]

First of all, thank you all very much,
I have downloaded ad-aware and spybot S&D. Spybot works perfectly, but Ad-aware keeps not responding and I have to force it to quit. I will keep trying though. 1 thing I forgot to mention b4 is that my "system" window appears when I turn on my computer. Is that part of the spyware/adware or is that a setting I can change?
P.S. I think you guys are right, it isn't a virus technically

[Agent_Steal]

What OS are you running ad-aware on ? Windows 98 ? XP ?
You can try these :
[1] Do a search for *.tmp files and delete them
[2] Defragment your computer
[3] Try Re-installing it again

Not much else that I can think of. Maybe someone else can suggest something better. Any other suggestions ?

[altotheex13]

I reinstalled it and it works fine now, thanks I have windows ME

[altotheex13]

what really bothers me, though, is that "system" window pops up when I start the computer.
Can anybody give me some advice on that?

[Agent_Steal]

Now does that system window have like any name at the top ? What does it look like ? Does it say anything on it ?

[altotheex13]

I'm sorry, I should have been more clear. By "SYSTEM" window, I meant "SYSTEM" folder. Sorry, I'm a newbie. It looks like any other folder, for example My Documents. The address is C:\WINDOWS\SYSTEM. There are no objects unless you click on the link on the side that says:
"This folder contains files that keep your computer working properly. Please be careful if you modify the contents of this folder." Then the actual link, "View the entire contents of this folder."
Thanks again, for helping

[Fatphantom]

Try looking in your startup folder? If its not there, go to start - run - msconfig - then look at your startup files. If its not there either, get WinPatrol (http://www.winpatrol.com/) (theres a free version). It monitors your startup list and some other stuff. Alot of people would reccommend it.

[Cybr1d]

http://www.imchaos.com/alert.asp

--|| VIRUS ALERT : A new virus is spreading via AIM Profile links.. Read More ||--
--------------------------------------------------------------------------------


Do NOT click on links that say something like "whoaa look at what i found click here" or "I can't believe I found %n's Picture"

There appears to be a new virus/worm/spyware that is spreading via AIM profile links.

Apparently, malicious code is being placed on computer systems when victims visit either realphx.com or talkstocks.net (there may also be other domains).

This code is executed either when a visitor OKs at the prompt or automatically if the visitor has not patched Internet Explorer for known vulnerabilities (see Windows Update to patch your system).

Once the victim has been infected, their AIM profile will be changed to reflect only a link to one of the above mentioned sites with the text description as "Whoaa...look at what I found, click here" (there may also be other text descriptions). If the victim attempts to reset their profile, the link will reappear after a reboot or restart of AIM.

Due to variations of the virus/worm/spyware it may take a little work to completely clean it from your system.

Below are some links to removal tools we found (but did not test) followed by some manual instructions that were posted on other sites:

Removal tools
http://j.wftp.org
http://digitalmatter.net/index.php
http://rcc.bgsu.edu/faq/FixMessageTrojans.htm

Manual Removal Instructions
http://www.ncsu.edu/resnet/pages/security/realphx.php
http://j.wftp.org


==========================================

That is if you did get that virus.

Do what the other posts above mine mentioned: Get Ad-aware and Spybot and try to clean up your system.