Osama Bin Laden capture hoax carries a Trojan

Beware of instant messages bearing news of Osama bin Laden's capture.

A new Trojan horse advertising program, called BuddyLinks, masquerades as a news website with a story on the al-Qaida leader's capture in an attempt to fool users of AOL instant-messenger into downloading software and receiving advertising.

Although the software has some of the properties of an internet worm, the program has been classified by security software company Symantec as a lesser form of an irritant known as adware. BuddyLinks doesn't qualify as malicious, because it doesn't delete anything and can be easily uninstalled, said Steve Trilling, senior director of research for Symantec.

"In many cases, the difference between malware and software is how aware you are of what the program is doing," Trilling said.

Many security products will block programs that have been deemed to be adware or spyware, depending on the user's settings.

Spyware and adware have become irritations to internet users. The first sign a user may get that they are infected is a change of homepage or excessive repetition of particular ads irrespective of what sites they are surfing. Almost 1,300 adware program were released on the internet last year, according to security software firm PestPatrol.

The application sends an IM to every person on an America Online user's buddy list and includes a link to a fake TV news website. A dialog box then asks if the user wants to install a "news player". However, the program instead plays a simple animated game, reconfigures AOL's instant messenger to receive advertising and once again sends a link to the fake news website to everyone on the new victim's buddy list.

The spread of the software between IM users has angered AOL, which could sue the creator of the program, AOL spokesman Andrew Weinstein said.

"We are strongly opposed to this piece of adware," Weinstein said. "It's a particularly slimy piece of software, and we are looking into legal and/or technical steps we can take to prevent this from affecting our users."

Robert Lemos writes for News.com