AIM Profile hacks

Mitth`raw`nuruodo · Post by **Mitth`raw`nuruodo** » 2004-03-06 10:28pm

I've been seeing these a lot recently, they replace users' AIM profiles with things such as "Happy Holidays Everyone!! New Years 2003 Partayy!" or "I CAN'T BELIEVE I FOUND %N'S PICTURE HERE!!!! HAHAHAHA" They have a link they expect you to click, which I'm assuming is a Bad Thing (I never clicked one.).

Is there any way to get rid of these once they have taken over your profile? They seem to come back whenever you try to change your profile.

Shrykull · Post by **Shrykull** » 2004-03-09 11:01pm

I had that, all I did was change my profile and it never came back.

Exonerate · Post by **Exonerate** » 2004-03-09 11:30pm

If it keeps coming back, I'm guessing it might be a virus that keeps re-writting the profile each time Windows starts up. There has to be some other component if it keeps coming back...

Einhander Sn0m4n · Post by **Einhander Sn0m4n** » 2004-03-09 11:49pm

I think it's the BuddyLinks Virus. The company who created it is called PSD Tools.

IMNSHO, PSD needs to burn in Hell...

Mitth`raw`nuruodo · Post by **Mitth`raw`nuruodo** » 2004-03-10 12:04am

Nope, not quite.

Exact text of one of the profile viruses:

I can't believe I found <your screename>'s Picture here*
HAHAHA

*URL leads to http:// www. buddypicture.net ... Do not visit! It's probably not good. (duh.)

Italics mine, just to show that it's something I changed. It'll usually show your screename.

Mad · Post by **Mad** » 2004-03-10 01:25am

It's known as the Buddypictures Virus (though technically it's not a virus). It also tends to install realphx onto your system, as well. Those pages have instructions for removing the garbage.

To my knowledge, the adware only installs through Internet Explorer. And, apparently, it does so silently. When people get infected by it, they tend to complain that "the page doesn't work" or it's a blank page. So they refresh it several times trying to get it to work. I admit that I have clicked on the link before, as well... except that I was using Firebird and so was immune to its attack. The page tells visitors that by visiting the page, they agree to allow adware to be installed.

aphexmonster · Post by **aphexmonster** » 2004-03-10 04:28pm

ahhh... thats why the page was blank

i clicked on it myself, but my computer prompted me that information was being sent to my computer and i closed the application ...

those bastards