*New AIM profile trojan--buddypicture.net trojan*

[Cybr1d]

Information on buddypicture.net trojan



If you have a link in your AIM titled "buddypicture.net" it means your machine has been infected by the buddypicture.net trojan.

The virus exploits a flaw in Internet Explorer and forces the download of the trojan to your computer and runs it. When it starts, the trojan puts a link in your AIM profile that that forces the download of the trojan to your computer. Messages can be "I can't believe I found (your screen name)'s picture here HAHAHA" or similar. Once it changes your profile, it will begin downloading adware and spyware to your computer. Changing your AIM profile won't get rid of the virus, it will simply change it back on your next reboot.

If a link in your aim is titled "buddypicture.net" you will need to remove the trojan using adware removal software.

Removal:

You will need to run adware removal software on your machine, we would suggest the sites listed below,

Pastol - site contains software to remove spyware and adware

Spywarenuker - another piece of software to remove spyware and trojans

Besides their suggestion for spyware removal, you can always use the traditional Ad-ware and Spybot S&D. Running your AV and a Trojan Cleaner such as theCleaner is recommended.

[MilitantEidolon]

Where did you get this article I would like to look at it?

Its always good to post a link.

- MilitantEidolon

[Cybr1d]

i pulled it off someone's buddy profile

Here's the link: http://www.buddypicture.net/announcement/

[MilitantEidolon]

Thanks!

- MilitantEidolon

[Soda_Popinsky]

To my understanding, this would only work if you clicked a link in a profile. There are variants such as talkstocks, buddypicture, and a couple others, most of which were shut down. I've seen these and been fixing these for almost a year now, but your quote says it exploits a flaw in IE? That's news to me, the ones I dealt with prompt a download.

[Spyder32]

To my understanding, this is fairly old. I've known about this for atleast 6-8 month's and it has been a bother to nearly all of my computer illiterate friends. Thanks for the notice though, Cybr1d!

[Cybr1d]

To my understanding, this is fairly old. I've known about this for atleast 6-8 month's and it has been a bother to nearly all of my computer illiterate friends. Thanks for the notice though, Cybr1d!

NP. I wasn't aware it was out for that long. I just noticed it on someone's buddy profile and figured I'd share it. Still, if anyone comes here looking for info on it, they can find it in AO. After looking around a bit, I guess it has been around since December/January.

I bet 20 bucks that someone will actually start posting asking about how his AIM is hacked .

[Spyder32]

Haha, yeah.. I wonder if that site has been reported yet or something. I'ma do a whois on it (it's on a domain, right?) and see who it's registered to, blah blah.. Should be interesting.

[Cybr1d]

the site has been reported and shut down afaik

[Soda_Popinsky]

buddypicture.net/announcement // don't be stupid, view this site w/ restricted settings

buddypicture has been taken down for quite a while, but I think some hijacked profiles have lingered around.

PoC's have been released for the more recent highly critical Aim vuln, so I would expect some spyware / trojan problems from that.