NYT/CNET: Instant Messenger Worms on the Prowl

[DeepModem Mom]

Instant Messenger Worms on the Prowl
By CNET News.com
Published: March 8, 2005


New worms that use Microsoft's instant-messaging software to spread are tunneling their way across the Web.

Antivirus companies on Tuesday flagged a variation of an existing threat and a new worm, both targeting MSN Messenger.

Researchers at both Aladdin Knowledge Systems and F-Secure discovered the appearance of Win32.Kelvir.a, a new twist on the previously identified Kelvir threat. Each company also identified a new worm in the wild; Aladdin is calling it Win32.Serflog.a., while F-Secure is calling the same threat Sumom. Aladdin is rating both Win32.Kelvir.a and Win32.Serflog.a as medium-to-high risks.

The appearance of the new worms underscores the growing popularity of malicious software that relies on instant messaging, or IM, to spread. It follows a similar attack last month by another program meant to use Messenger to spread itself. In early February, researchers at Trend Micro detailed a variant of the Bropia worm that used Messenger. The Bropia.f worm was packaged with a second, more damaging worm that tried to exploit computers with improperly patched software.

While Microsoft spokesmen were quick to point out that the Messenger attacks do not take advantage of any flaw in the software, the company said it recommends that customers exercise "extreme caution" when accepting file transfers from both known and unknown sources on IM.


http://www.nytimes.com/cnet/CNET_2100-7349_3-5604060.html