Mass mailing worm affecting AIM

Question

On my son's computer, AIM looks to be infected by a mass mailing virus. McAfee found a known virus last night during a scan (c:\install.exe, I think it said) which I deleted after receiving the "this file could not be cleaned" message. But today his AIM is auto starting again and mass mailing every 10 minutes or so. I disabled the AIM auto sign-on but am wondering what else needs to be done to get clear of this. Thanks in advance for any help you can provide! kh.

Answer

This question was answered on February 22, 2006. Much of the information contained herein may have changed since posting.

The virus is a worm that was downloaded from an instant message. The worm is new and is attacking AIM. It doesn't only mass mail but will start to delete all data from drives A to P.

1. Disable system restore by following these instructions:

Click the Start button.

Right-click My Computer, and then click Properties.

On the System Restore tab, check Turn off System Restore or Turn off System Restore on all drives as shown in this picture on website: http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001111912274039?OpenDocument&src=sec_doc_nam

Then click apply.

2. Update your McAfee.

3. Run a full system scan and delete files labled VBS.Laske@mm.

If this doesn't work you might have to re-install the operating system and all the programs, and restore all the data from a clean backup.

Author

Posted by kara of Chandler-Gilbert Community College on February 22, 2006