Erich_870

Well, I'll admit it. I'm an idiot I came home from work yesterday to an AOL Instant Message from a guy I used to hang out with in high school. It said, "should I post this pic of us on myspace.com" and then had a photobucket link. I clicked on it thinking he found some geeky photo and wanted to flip me some Here's when I made the stupid mistake. It didn't take me to photobucket but instead asked me if I wanted to run an execute or something. Why did I click run? Don't know, I didn't really think about it.

Now I have the IM Worm and its sending the exact same message to everyone on my buddy list who's logged on. I warned all the people on line today, and I caught it sending its message.

How do I remove it? I really don't want it to corrupt my system I've uninstalled IM for now in hopes it will keep my friends safe.

I also have run the free version of AVG, Ad-ware SE, and the Windows defender (which hasn't impressed me yet)

Thanks for any help. :cry:

Erich

photoleif

did you virus-scan and purge the bad registry values? also, check out the SAV site: http://securityresponse.symantec.com/avcenter/venc/data/w32.allim!gen.html

if that's not your aim virus, or if it didn't work, you could try this: http://www.softpedia.com/get/Antivirus/AIM-Fix.shtml

Erich_870

Well, I went to Symantec and did as it said and read through the registry and didn't find any thing called w32.allim!

so then I went to the softpedia and downloaded the AIM-fix and it said it took care of it.

I just reinstalled AIM, so we'll see if I was successful.

Erich

photoleif

cool. hope that works and your friends don't pummel you for having "sent" worm trails at them.

Erich_870

I know, but thankfully the only people online where folks I haven't talked to in a long time Once I realized it was sending it's message of destruction, I sent everyone online the follow up message of not to open it.

So far it hasn't reappeared so I might have gotten rid of it.

Erich

photoleif

nice. just be sure that it didn't install any DLLs on you -- those wouldn't be uninstalled by removing AIM and reinstalling it, and it may rear its head sometime. i doubt it but do want to be sure you're cautious. as part of an overall self-protection strategy, i regularly review what programs run on startup. you could do sysinfo, or use "autoruns" like i do -- it's freeware from sysinternals.com. this won't protect against an AIM worm, but it will help you examine all the crap that runs on startup, some of which may turn out to be malware.