ALERT: super fast spreading spyware - Tilted Forum Project - TFP - Sexuality, Philosophy and Political Discussion

JStrider · 02-10-2004, 08:20 PM

if you recieve any msgs on aim like this one"check this out: http;//www,wgutv,com/osama_capture.php?7HRf"

dont go to it... it installs some spyware and then starts sending the message out to people on your buddy list...

its not too hard to uninstall if you do get it... just go to the new folders it makes in your programs menu and uninstall... and run spybot or ad aware just to be safe...

meanspleen edit: I deliberately broke the link so that no one accidentally clicks on it

Lasereth · 02-10-2004, 08:23 PM

Yeah, my friend got it. She's already uninstalled it, but you're right, it hit the Internet like a wildfire.

-Lasereth

JStrider · 02-10-2004, 08:25 PM

you shoulda seen how fast it spread thru the dorms.... all of a sudden everyone was out in the hall... "wtf are you getting those messages from me???"

SonicRL · 02-10-2004, 08:47 PM

Heh..thanks for the heads up. My online friend just recently IMed me saying to watch out for an "Osama Captured" IM because it is spyware and that his friend was already infected.
I also usually ignore IMs that usually say something to the effect of "CHECK THIS OUT" or "LOOK I FOUND YOUR PICTURE ONLINE!!" because I usually suspect it's spyware.

nanofever · 02-10-2004, 09:07 PM

*hugs Firefox*

bltzkriegmcanon · 02-10-2004, 09:30 PM

Thanks for the warning. My girlfriend got it earlier this evening, what a pain in the ass.

sailor · 02-10-2004, 09:44 PM

Quote:

Originally posted by nanofever
*hugs Firefox*

*Hugs his Linux box*

Bah, crap like this annoys me. Gotta love people trying to make a quick buck...

tritium · 02-10-2004, 10:52 PM

I need to know the name of this bug. Anyone have a name?

JStrider · 02-11-2004, 08:53 PM

http://story.news.yahoo.com/news?tmp...pcworld/114745

theres an article about it

micah67 · 02-11-2004, 09:08 PM

Thanks for the heads-up. I'm sure I'll see the issue at work...

Fearless_Hyena · 02-11-2004, 11:06 PM

Wow I actually got that AIM msg but didn't know it was this spyware worm! I wouldn't have installed whatever it wanted me to anyway, since it was supposed to be some version of Realplayer (Real Alternative instead) an I use Mozilla, so the scripting on their site obviously didn't work. How lame

Cynthetiq · 02-12-2004, 09:03 AM

what folders does it create? what's the names to remove? I've not seen it yet, but other friends have it and I cannot help them remove it since I cannot see it remotely.

Mr_Q · 02-12-2004, 06:30 PM

Yeah, A buddy of mine got one of those today. I trust him, and might have normally just clicked the link to see what he was sending me... but the fact that the IM came BEFORE my AIM even finished starting up scared me away. good thing, too.

Lokus · 02-12-2004, 08:09 PM

Heh, my roommate got it. He sent it once to me legitimately and then the game sent another message to me. Seeing the two in a row tipped me off it was a virus plus I read the terms and conditions.

JStrider · 02-13-2004, 12:17 AM

makes a buddylink folder in program files... i think thats it... there may be some registry entries or other files that im not aware of... but that was the main one i saw... and it puts a program group in the start menu

JohnnyRoyale · 02-13-2004, 11:48 AM

According to what' I've read & seen, the AIM messages send out a broadcast to your entire buddy list, inviting them to download some Osama game. When the user downloads the game, the Buddylinks program is piggybacked on the software, which then sends a message to their buddy list, and so on and so on.

Here's a good look at the Buddylinks program installation specs:
http://us.mcafee.com/virusInfo/defau...virus_k=101007
Should also include removal tools, but if it doesn't, here's AIM's official what to do:
http://www.aim.com/help_faq/security/trojan.adp

BTW, the links all seem to come from the wugtv domain, if your an admin, might want to redirect that to localhost for a while.

ariekitten · 02-13-2004, 11:30 PM

lots of users have been calling in with similar problems.....
so i can guarantee it's not just going around on aim, but i don't have all the details...

02-10-2004, 08:20 PM	#1 (permalink)
JStrider Poo-tee-weet? Join Date: Apr 2003 Location: The Woodlands, TX	ALERT: super fast spreading spyware if you recieve any msgs on aim like this one"check this out: http;//www,wgutv,com/osama_capture.php?7HRf" dont go to it... it installs some spyware and then starts sending the message out to people on your buddy list... its not too hard to uninstall if you do get it... just go to the new folders it makes in your programs menu and uninstall... and run spybot or ad aware just to be safe... meanspleen edit: I deliberately broke the link so that no one accidentally clicks on it __________________ -=JStrider=- ~Clatto Verata Nicto Last edited by meanSpleen; 02-10-2004 at 10:09 PM.

02-10-2004, 08:25 PM	#3 (permalink)
JStrider Poo-tee-weet? Join Date: Apr 2003 Location: The Woodlands, TX	you shoulda seen how fast it spread thru the dorms.... all of a sudden everyone was out in the hall... "wtf are you getting those messages from me???" __________________ -=JStrider=- ~Clatto Verata Nicto

02-10-2004, 08:47 PM	#4 (permalink)
SonicRL Insane Join Date: May 2003	Heh..thanks for the heads up. My online friend just recently IMed me saying to watch out for an "Osama Captured" IM because it is spyware and that his friend was already infected. I also usually ignore IMs that usually say something to the effect of "CHECK THIS OUT" or "LOOK I FOUND YOUR PICTURE ONLINE!!" because I usually suspect it's spyware. __________________

02-10-2004, 09:07 PM	#5 (permalink)
nanofever Huzzah for Welcome Week, Much beer shall I imbibe. Join Date: Apr 2003 Location: UCSB	hugs Firefox __________________ I'm leaving for the University of California: Santa Barbara in 5 hours, give me your best college advice - things I need, good ideas, bad ideas, nooky, ect. Originally Posted by Norseman on another forum: "Yeah, the problem with the world is the stupid people are all cocksure of themselves and the intellectuals are full of doubt."

02-10-2004, 09:30 PM	#6 (permalink)
bltzkriegmcanon Holy Knight of The Alliance Join Date: Dec 2003 Location: Stormwind, The Eastern Kingdoms, Azeroth	Thanks for the warning. My girlfriend got it earlier this evening, what a pain in the ass. __________________ What do you say to one last showdown? - Ocelot, Metal Gear Solid 3 The password is "Who are the Patriots?" and "La-Li-Lu-Le-Lo." "La-Li-Lu-Le-Lo." Gotcha. - The Colonel and Snake, Metal Gear Solid 3

02-10-2004, 08:23 PM	#2 (permalink)
Lasereth Knight of the Old Republic Join Date: May 2003 Location: Winston-Salem, NC	Yeah, my friend got it. She's already uninstalled it, but you're right, it hit the Internet like a wildfire. -Lasereth

02-10-2004, 10:52 PM	#8 (permalink)
tritium Professor of Drinkology Join Date: Jun 2003 Location: Wasting away again in Margaritaville	I need to know the name of this bug. Anyone have a name? __________________ Blah. Last edited by tritium; 02-10-2004 at 10:58 PM.

02-11-2004, 08:53 PM	#9 (permalink)
JStrider Poo-tee-weet? Join Date: Apr 2003 Location: The Woodlands, TX	http://story.news.yahoo.com/news?tmp...pcworld/114745 theres an article about it __________________ -=JStrider=- ~Clatto Verata Nicto

02-11-2004, 09:08 PM	#10 (permalink)
micah67 Thor Join Date: Jun 2003 Location: 33:08:12N 117:10:23W	Thanks for the heads-up. I'm sure I'll see the issue at work... __________________ ~micah

02-11-2004, 11:06 PM	#11 (permalink)
Fearless_Hyena Hello, good evening, and bollocks. Join Date: Apr 2003 Location: near DC	Wow I actually got that AIM msg but didn't know it was this spyware worm! I wouldn't have installed whatever it wanted me to anyway, since it was supposed to be some version of Realplayer (Real Alternative instead) an I use Mozilla, so the scripting on their site obviously didn't work. How lame

02-12-2004, 09:03 AM	#12 (permalink)
Cynthetiq Tilted Cat Head Administrator Join Date: Apr 2003 Location: Manhattan, NY	what folders does it create? what's the names to remove? I've not seen it yet, but other friends have it and I cannot help them remove it since I cannot see it remotely. __________________ I don't care if you are black, white, purple, green, Chinese, Japanese, Korean, hippie, cop, bum, admin, user, English, Irish, French, Catholic, Protestant, Jewish, Buddhist, Muslim, Indian, cowboy, tall, short, fat, skinny, emo, punk, mod, rocker, straight, gay, lesbian, jock, nerd, geek, Democrat, Republican, Independent, either you're an asshole or you're not. What's the best nation in the world? DO-NATION!

02-12-2004, 06:30 PM	#13 (permalink)
Mr_Q Tilted Join Date: Jun 2003 Location: Minnesota	Yeah, A buddy of mine got one of those today. I trust him, and might have normally just clicked the link to see what he was sending me... but the fact that the IM came BEFORE my AIM even finished starting up scared me away. good thing, too.

02-12-2004, 08:09 PM	#14 (permalink)
Lokus I can't think of a good title Join Date: Apr 2003 Location: East Bay Area, CA	Heh, my roommate got it. He sent it once to me legitimately and then the game sent another message to me. Seeing the two in a row tipped me off it was a virus plus I read the terms and conditions. __________________ The black wind howls...

02-13-2004, 12:17 AM	#15 (permalink)
JStrider Poo-tee-weet? Join Date: Apr 2003 Location: The Woodlands, TX	makes a buddylink folder in program files... i think thats it... there may be some registry entries or other files that im not aware of... but that was the main one i saw... and it puts a program group in the start menu __________________ -=JStrider=- ~Clatto Verata Nicto

02-13-2004, 11:48 AM	#16 (permalink)
JohnnyRoyale Psycho Join Date: Jan 2004 Location: Boston, MAss., USA	According to what' I've read & seen, the AIM messages send out a broadcast to your entire buddy list, inviting them to download some Osama game. When the user downloads the game, the Buddylinks program is piggybacked on the software, which then sends a message to their buddy list, and so on and so on. Here's a good look at the Buddylinks program installation specs: http://us.mcafee.com/virusInfo/defau...virus_k=101007 Should also include removal tools, but if it doesn't, here's AIM's official what to do: http://www.aim.com/help_faq/security/trojan.adp BTW, the links all seem to come from the wugtv domain, if your an admin, might want to redirect that to localhost for a while. __________________ I'm gonna be rich and famous, as soon I invent a device that lets you stab people in the face over the internet.

02-13-2004, 11:30 PM	#17 (permalink)
ariekitten bAck iN aCtiOn! Join Date: Apr 2003 Location: in my imagination	lots of users have been calling in with similar problems..... so i can guarantee it's not just going around on aim, but i don't have all the details... __________________ I am known as Valentinez Alkalinella Xifax Sicidabohertz Gombigobilla Blue Stradivari Talentrent Pierre Andri Charton-Haymoss Ivanovici Baldeus George Doitzel Kaiser III. Don't hesitate to call. ~Vash, Trigun >'.'< kitty kitty, meow ^..^~