December 6, 2005 5:43 PM PST
New IM worm chats with intended victims
- Related Stories
-
Study: IM worms up again in November
November 29, 2005 -
AIM worm plays nasty new trick
October 28, 2005 -
IM worm speaks your language
August 24, 2005
A new worm that targets users of America Online's AOL Instant Messenger is believed to be the first that actually chats with the intended victim to dupe the target into activating a malicious payload, IM security vendor IMlogic warned Tuesday.
According to IMlogic, the worm, dubbed IM.Myspace04.AIM, has arrived in instant messages that state: "lol thats cool" and included a URL to a malicious file "clarissa17.pif." When unsuspecting users have responded, perhaps asking if the attachment contained a virus, the worm has replied: "lol no its not its a virus", IMlogic said.
The malicious file disables security software, installs a backdoor and tweaks system files, the company said. Then it starts sending itself to contacts on the victim's buddy list.
But the worm is programmed so that the infected user cannot see the messages that are being sent out by the worm, according to IMlogic.
"This is a first," said Andrew Burton, director of product management at Waltham, Mass.-based IMlogic. This worm is not widespread, but attackers are just trying out this new technique, he said. "We will see one or two instances of an attack, there will be a refinement and then there will be an outbreak."
The inclusion of an IM bot is another sign that IM worms are becoming more sophisticated. Another worm, also spotted on Tuesday, takes a more traditional route: it spreads under the guise of a holiday greeting card, IM security specialist Akonix Systems said Tuesday.
The holiday worm, dubbed Aimdes.E, targets AIM users and arrives with the message: "The user has sent you a Greeting Card, to open it visit:" followed by a link. Once the target clicks on the link, the worm installs itself on the system. It opens a backdoor on the computer and sends itself to contacts on the buddy list, Akonix said.
Advice to users is to be careful when clicking on links in IM messages--even when they seem to come from friends--and to use up-to-date antivirus software. When receiving a link in an instant message, the best practice is to verify with the sender if the link was sent intentionally or not.
See more CNET content tagged:
IMLogic,
worm,
Akonix Systems,
IM,
victim
Of course, the worm will reply "lol no its not its a virus"
Hmm...Make up stories Think even if they are made up I would want the information. Thankyou Cnet.
Hmm...Links in the IM cause the problem. Don't type the whole string (link) to another user. instead of http://www.yadayada.com type yadayada let them type the string. ignore the bots see who is really in the room. watch it for a bit and you will be able to tell.
Like my windows. Keepin it.
Esk
if you like taking the long way:
-right click
-copy shortcut
-paste to desktop
-right click > properties
...that was tough.
Trojans these days are so widespread that it seems unlikely that they're even meant for malicious purposes anymore, so much as they are meant for seeing just how widespread you can make your virus go. Certainly, it makes the system of everyone it infects more vulnerable, but unless the person who creates the virus has a primary plan to actually send out something that will HURT your computer, it's not really worth worrying about the worm. Of course if you get it, you should remove it, and you should be taking necessary precautions to keep from getting it in the first place through use of common sense (as with this one, since obviously a .pif file is one of the least likely to be safe files around...) Or through the use of a good Antivirus program.
Unfortunately not everyone is quite so able to exercise common sense, so here is an easy to remember maxim for those people:
If you don't know how to use your computer effectively, Don't use it.
Computers don't work on their own. They are tools like any other. If your car breaks down, you have to get it fixed. If you computer breaks down, it will not fix itself. Know how your computer works, otherwise I can't be bothered to care when your computer stops working, and you don't know why.
These techniques have been floating around the Web for years. Back when I used ICQ in 1999, IM Bots sent me porno links all the time, so much I've never used ICQ since then. Also, the technique that only the message reciever sees the message is not new. Last year a friend of mine kept sending me messages with a strange URL, and when I asked him about it, he said he didn't know anything about it.
Both techniques are highly intrusive, but old. They have been used for malicious purposes for years. So why is it only now in the news? The fact that the links installs a Trojan may be the new catch, but it was only a matter of time.
defeated. Then I thought it would be better to check it out.
According to Trend Micro it affects: Windows 98, ME, NT, 2000, XP,
Server 2003
Will people never learn?
Cheers.
- NOT THE FIRST- Cnet is wrong here!
-
by Digital_Freedom
December 10, 2005 11:49 AM PST
- I agree.I actually had a yahoo messenger worm that did almost exactly the same thing in 2002-2003! The only difference was thatyou could read what the virus said to the victim (could read the "lol, cool.. check this link out" etc..) CNET: PLEASE DONT CALL THIS WORM THE FIRST THAT CHATS WITH A VICTIM TO DUP THEM TO CLICK A VIRUS INSTALL LINK. It's simply NOT TRUE.
-
Reply to this comment
-
-
See all 43 Comments >>