Two Internet Worms Target MSN Instant Messenger Users   3/25/2005 - 2,772 views, 4 Comments

Summary: MSN Messenger has been added to the list of instant messenger programs which require heightened vigilence. Two security companies have discovered that there are two worms, one old and revised, and one new, which are targetting MSN Messenger users. As if ...

Previous Article « Yahoo Messenger Target of Effective Phishing Scam
Read Next Article » A Really Neat Use of the Internet: MyDollarBill.com


MSN Messenger has been added to the list of instant messenger programs which require heightened vigilence. Two security companies have discovered that there are two worms, one old and revised, and one new, which are targetting MSN Messenger users. As if we don’t have enough to worry about with phishers targetting Yahoo Messenger, and a security hole in Trillian.

The first is a variation on the Kelvir worm (Win32.Kelvir.a), and the latter is a brand new worm which as been dubbed by security company Aladdin Knowledge Systems “Win32.Serflog.a”, and which F-Secure is calling Sumom. Both worms are considered to be medium-to-high risk.

The Kelvir worm spreads itself by sending a message to an MSN Messenger user which contains a link. When the user clicks on the link, a program is downloaded to the user’s computer which, when executed, attempts to install multiple copies of itself on the user’s computer.

The Serflog or Sumom worm sends the target MSN Messenger user a message which reads something along the lines of “????omg click this!”. “This” is an attachment which, when clicked, drops the worm onto the user’s computer, and also installs hidden files which attempt to defeat MSN Messenger’s security features, and also blocks access to several websites.

As always, users should exercise extreme caution whenever presented with an unexpected file on an instant messenger client, or when someone they don’t know sends them a link.

Previous Article « Yahoo Messenger Target of Effective Phishing Scam
Read Next Article » A Really Neat Use of the Internet: MyDollarBill.com

Get a FREE summary of the week's articles every Friday!
(You can stop it any time!)
    *We never share your email address with anyone

Email Address:
Date of first visit:
How you found us:

Be sure to watch for the confirmation email!

Subscribe
to The Internet Patrol on your cell phone    Email the link for this page to a friend!

Read more:

»  Trillian Vulnerability - Security Flaw Found in Trillian IM Client

»  Yahoo Messenger Target of Effective Phishing Scam

»  New Kirvo Trojan Worm Sidekick Targetting AOL AIM and MSN Instant Messenger

»  Get Your Own Personal Web Instant Messenger Chat System - Free! - with Meebo

For additional similar stories check out our archives on Virus & AntiVirus, Worms

 

4 Comments »

  1. Damn this is fucked up

    Comment by Anonymous — 6/6/2005 @ 4:55 am

  2. I have been getting email messeges from women I don’t know saying that they saw my picture on msn messenger and they said I am hot. ????? I have not ever put any pictures up online and I don’t think I ever filled out any profile for msn messenger. Is this a scam or just misdirected emails?

    Comment by Brian — 8/12/2006 @ 7:53 pm

  3. ive been getting e-mail messeges from this guy and he has been e-mailing me and i dont even know him!!!!!!!im starting to freak out!!!!!! what should i do??:(

    Comment by markeyla — 8/25/2006 @ 12:34 pm

  4. I have been getting the same message. I am hot in the display pic and they want to know who I am and where I’m from. This is a scam! They want me to contact via msn instant message. (emilytightbutt) is the person sending this junk.

    Comment by anglo — 12/11/2006 @ 10:05 am

RSS feed for comments on this post.

Leave a comment

Warning! All comments which contain URLs and are clearly just spam to generate a link back to the URL will be deleted on sight. Don't bother wasting your time!

If you are going to include a URL in your comment,
please keep it under 25 characters in length,
or use TinyURL to shorten it before including it in your comment.

Line and paragraph breaks are automatic, your email address is never displayed.
HTML allowed: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

(required)

(required)


If you have not posted a comment here before, we apologize for having to ask you to enter the letters and numbers you see in the image above to validate your comment, but we are being attacked by thousands of comment form spams every day! You only need to do this once; once you have successfuly posted a comment here you will not be asked to do this again. Thank you for your understanding!

 
The Internet Patrol
Patrolling the Internet for You!