If your computer is infected with an instant messaging (IM) Trojan

If your computer is infected with an instant messaging (IM) Trojan, the remote attacker can, among other things, control chat sessions, send the Trojan to people on your buddy list, and perform Denial of Service (DoS) attacks using your computer.

If you're notified that your computer is sending a virus or participating in DoS attacks, immediately unplug the network cable and reformat and reinstall your operating system. Additionally, if you were running IM software while logged into your computer with administrative rights, any infection contracted through that software will have administrative rights also, and you will have to reformat and reinstall the operating system. It is not sufficient to simply remove the infection, because doing so will not remove any programs that may have been installed with administrative rights while the computer was compromised. For help reformatting and reinstalling your system, see:

• Safely rebuild your Windows computer
• Why you should reformat your hard drive and reinstall Windows after your computer is infected with a virus

It is safest to run IM software without administrative rights, as outlined in About the principle of least privilege. If you were following the principle of least privilege at the time of infection, University Information Security Office (UISO) at Indiana University may consider using a cleaning tool or deleting your profile instead of wiping your computer.