Hey All,
ive got a friend that has an AIM virus/spyware and she has enlisted my help to try and remove it from her system.

Incidentally i got a random IM from her a few weeks back with the link to this virus (obviously trying to transmit itself via her entire buddy list per usual for these types of viruses). Anyhow, i googled the name of the .exe referenced in the link and it came up with nothing....

does anybody know anything about an AIM virus/spyware that references a .exe called

socks8b

there were some other things in the link that i thought were interesting.. but may or may not have anything to do with the virus itself

thx All,
Branco

AIM Virus Clean

Not used this tool so I can't say it will work, but I found it from another forum. Use at own risk

However I'll post here what I'd post in the gladiator security forum.

If you think you are infected submit a hijackthis log to the HJT Forum.

Please read before submitting

Download Hijackthis

Try running the following from safe mode (Getting to safe-mode) Sysclean you'll also need the virus template file from here lpt***.zip remember to extract the contents of the zip file into the same folder as Sysclean.com

or

DrWeb CureIT

or

KASFX which is powered by the Kaspersky AV engine, you will need internet access to update it. If you haven't got net access in safe mode, update it before you use it.

If your good with the command line also try Sophos Command Line scanner this command will scan all of your hdd's SAV32CLI.EXE -F -di -remove -dn -mbr -all -zip -p=avscanlog.txt and give you a log file to review afterwards.

Also try installing and running A2 Free and Ewido again run from safe mode.

I'd also run Spybot and Adaware

If your using Win2K/XP run adaware/spybot from "safe mode with command prompt"

At the C:\ prompt type the following:-

cd\
C:\progra~1\spybot~1\spybotsd.exe /autocheck /autofix
cd\
C:\progra~1\lavasoft\ad-awa~1\ad-aware.exe

Great Thanks Stidyup