AIM buddy lists spreading virus

Meranda Watling

Instead of chatter and procrastination, students on AOL Instant Messenger are sharing something else their final week of classes: a new virus.

The virus, which LAN administrator Wendy Shih said ResNet first saw on campus over the last week, is spread from one infected user to another by a link in instant messages and is a type of Trojan. Trojan viruses perform unexpected and unauthorized actions, such as sending messages or erasing files, according to the ResNet Web site.

The virus sends a message to everyone on the infected user?s buddy list. The message says, ?Hey check out this.? The word ?this? is a link, which downloads the program when clicked.

Shih said ResNet saw maybe 10 to 20 users come in yesterday with the virus, which McAfee calls ?oscarbot.? McAfee rates the virus as low risk.

?If your computer is infected, it may allow a remote server to connect to it. Then your computer can be used for unauthorized remote access,? Shih said. ?Basically, others could have control of your computer and information on it.?

If infected, the attacker could come in and download and execute files and send a message to AIM contacts using the computer.

Jayloden.com, which offers the program AIMFix to help remove the virus, advises, ?The virus steals passwords and user names for some people, so change your password immediately and verify the e-mail address for your account is not changed!?

The program may also download and install spyware on the computer, Shih said.

?When users come in (to ResNet), their CPU is almost full because of the virus,? Shih said. ?The spyware running in the background stays busy even when they have nothing open.?

To avoid getting the virus, Shih suggests users keep Windows updated an update anti-virus and anti-spyware programs.

?Do not click on the link you do not know,? she said. ?This is not the first time this has happened. If you?re not actively talking to that person and they randomly send you a link, don?t click on it.?

Freshman nursing major Meredith Severns was one of the students on campus infected with the virus.

?A friend on my buddy list, she got it and sent it to all the people on her list,? Severns said. ?She sent me a link, so I clicked on it.?

Severns said a box came up on her screen, and, ?Things went crazy, and it sent an instant message to all the people on my list.?

Severns tried to fix the problem with virus checkers, but because she was infected Saturday and McAfee and Norton didn?t identify the virus until Sunday, it wasn?t even recognized. She even uninstalled and reinstalled AIM to try and fix it.

?I thought it was gone, so I left,? she said. ?When I came back, it did it again like three times.?

?It was more frustrating than harmful,? Severns said. ?People kept telling me, ?You got a virus.?? Yeah, I know. I just can?t get rid of it.?

ResNet has information, including a link to instruction on how to remove the virus, at its Web site,