[AMJones]

To remove the AIM profile viruses that have been going around, I would suggest you try the following solutions:

• Visit this site to use their automatic removal tool: http://www.jayloden.com/VirusClean.htm
  
  This has been tested and appears to work for the "Click here to see what I found...", "Whoa, look what I found", " I can't believe I found... Picture here" worms from AOL profiles. If it doesn't work for you the first time, reboot and give it another try.
  
  If you have the ""an0th3r pr0fil3 0wN3d By b1Ld0" worm, you will need to use the manual removal instructions below.
  
  Please consider donating to the site above, as they are providing the fix for free, which costs them money in terms of hosting the website, etc.

If that solution doesn't work (rare), try the instructions below for manual removal.

1. Press on your keyboard to bring up the task manager. In some operating systems, you may also have to click "Task Manager".
   
2. If using Win2k or WinXP, click on the "processes" tab
   
3. Look through the list of the programs for any of the following: b.exe, av.exe, bi.exe, biprep.exe, cnbabeie.exe, syslaunch.exe, winfavorites.exe, randomiser.exe, snd332.exe. Highlight each one you find, and click the "End Process" button in the lower right hand corner of the screen. After you've ended them all, you can close the task manager by clicing the X or "Cancel".
   
4. Double click "My Computer" > C: > Windows (after clicking windows, you may have to click "show files") to see the list of files. Look again for any of the file names that are listed in the step above. If you find any of them, you should delete them (right click, Delete).
   
   To find them easily, you should be able to click any file in that folder, then type the first few letters of the file you are looking for. After deleting all of the files, close the window and empty your recycle bin.
   
5. Click Start > Run, type in "msconfig" in the box, then click OK. The System Configuration Utility will launch. After it loads, click the "Startup" tab.
   
6. Look through the list here for the same list of files above. If you see any of them, uncheck the box to the left of it. This will prevent the worm from loading again when you restart your computer. After you've removed them all, click OK and restart your computer.
   
7. The System Configuration Utility may load again when Windows starts. If it does, click the checkbox for "Never show me this messsage again".
   
8. Remove that silly link from your profile. I'm pretty sure you already know how if you've gotten this far.
   
9. If the homepage on your browser has been changed, you may change it back by right clicking on the "Internet Explorer" icon on your desktop, clicking "Properties", then changing the address as you see fit. I'd suggest http://www.theideaweb.com as a good home page.
   
10. Last but not least, take some steps to prevent getting reinfected. Visit http://windowsupdate.microsoft.com and get all of the critical updates.

AOL has also posted their own instructions for removal of these sorts of infections. Here's a link: http://www.aim.com/help_faq/security/trojan.adp

If these instructions don't get rid of your issue, and you've followed each and every step... please reply to this thread with the following information: Version of AIM, what the link in your profile says, version of windows.



Hope this helps!

[costa324]

None of those instructions worked, probably because I have a new profile virus.. I have Dead AIM.. the thing in my profile is an0th3r pr0fil3 0wN3d By b1Ld0 and the hyperlink is url removed for security reasons and I have Windows XP.. any ideas ..? You can email me-- KCosta324@yahoo.com or IM me -- iCy 324 kiSs -- thanks a lot

[jenneking]

Those instructions did not work for me either. I have a virus that says "slideshow from last weekend, check it out!" put into my profile. I have AIM 5.2 and windows XP. Please help. My email address is jenneking@depauw.edu.

[costa324]

http://www.jayloden.com/VirusClean.htm


Yesterday some lovely ( )soul sent me that link and it has a bunch of removers.
YAY!!!!!!!!!!!!!!

[jenneking]

the virusclean links don't work for me, but thanks anyway. i still have it, so i'd appreciate any other ideas.

[Matt]

Originally posted by jenneking
the virusclean links don't work for me, but thanks anyway. i still have it, so i'd appreciate any other ideas.

Have you also tried this link?
http://www.jayloden.com/VirusClean.htm

[jenneking]

i've tried all of the links, none seem to work in my case.

[AMJones]

The manual removal instructions have been updated for the "an0th3r pr0fil3 0wN3d By b1Ld0" version of this annoyance. The instructions do work, if followed carefully.

[jenneking]

the snd332.exe process was not there. i still downloaded the bildo remover and tried it anyway but the virus is still there.

[AMJones]

Well, one of the programs in your task list is the worm. If it's not one of the programs listed above, then you'll need to spend some time figuring out which one it is. Unfortunately, a great deal of them are also necessary to run your computer; so if you end task on the wrong thing you'll end up rebooting, but rebooting isn't so bad.

Good luck!

[jenneking]

thank you for you interest.

Is this profile virus taken care of by the removers on the links:

I can't believe I found %n's Picture here
HAHAHA

Removal instructions for the "Another Profile Owned by b1Ld0" virus only worked for a few minutes. A few minutes later, the link re-appeared. Using Windows 2000, AIM version 5.2.3292, and the link reads an0th3r pr0fil3 0wN3d By b1Ld0

[AMJones]

If the instructions worked only for a few minutes, then you did not remove the correct file. You would need to figure out which filename (as listed in the taskmanager) is causing the problem, and work from there.

[jenneking]

i think the process name is MSCVT.exe
delete that and i think you should be good.