|
Every now and then a new virus is created that distributes itself out over Instant Messengers (namely AIM
or MSN). Sometimes it will send messages to all its victim's buddies, and sometimes it will just insert a
hyperlink into their AIM profile. Here are some tips for recognizing viruses:
- If a person tries to send you a file over Instant Messenger or e-mail, check the file extension:
files ending in extensions such as EXE, COM, BAT, BIN, SCR, or other unusual extensions are
usually not safe to download. Also be sure they don't try to trick you in the extension
(i.e. a file named "My picture.jpg.exe" -- while .jpg is an image extension, they also
tacked on .exe--a potentially dangerous extension--and that makes ALL the difference)
- See the person's font. If they IM you and say "hey" and their font is blue Comic Sans MS, and then
they say "Hey, wanna see my new pic?" and the font is in red Arial Black, then the messages that
stand out usually aren't them sending it, but a virus. If somebody starts talking to you
in two different fonts like that, don't trust ANY files they try to send you.
- Some virus programmers aren't very bright and will add useless features just because they can. In
the example of the CHOKE virus (1999 ish), it would say "George W. Bush is typing..." in the
typing dialog space. Your contact's name probably isn't George W. Bush, but if their typing
notification shows a different name than their own, it's usually a sign of trouble.
- AIM viruses don't tend to use File Transfer or Direct IM as much, they tend to just give you
innocent looking hyperlinks (i.e. "this was cool, check it out!" or "I can't believe I
found %n's picture here"). Always check the URL before clicking! Don't follow any link
that goes to a file on the web with one of the extensions listed above.
- Standard AIM Client (from aim.com)
- A tip to always know is that you can preview the URL of a hyperlink without clicking it.
If you hover your mouse over the link, a tooltip will pop up revealing the URL that the
link is going to. Even if it begins with http:// in their message, the link may not actually
go to the site you see there. Always hover your mouse over the URL to make sure before
clicking.
- Other Clients
- If your client has the ability to preview a hyperlink's destination, always check that before
clicking on ANY link somebody sends you. If not, most clients will allow you to copy the URL to your
clipboard. Doing this will let you paste it again somewhere else, letting you see where it linked to.
If you are infected with an IM virus, it's highly recommended that you switch IM clients until you
are able to remove the virus. Most of these viruses know how to use the standard AIM, MSN, or other clients. If
you use unstandard clients (such as Trillian or Miranda), the virus is less likely to know how to hack the client
to distribute the virus. If you get the same problems on an unstandard messenger (i.e. your buddies are still telling
you that you keep sending them a link to the virus), keep trying other clients until you find one that the virus doesn't
affect.
I'll try to update this document as often as possible with new advice for how to keep yourself safe from messenger
viruses. If you come up with anything that should be added here, e-mail me at:
cjk "@" aichaos.com
|