Users of Microsoft's MSN Messenger should be aware of a new ‘smart’ worm that checks the configuration of their Windows client and sends a message in the appropriate language, according to security companies Akonix Systems and Symantec. Both companies published alerts on Wednesday.
The Kelvir.HI worm, a variant of the Kelvir IM (instant message) malware that surfaced earlier this year, appears to be the first IM bug capable of checking systems settings and communicating in the victim's native tongue.
When the worm penetrates a system, it sends a message in one of several languages, including Dutch, English, French, German, Greek, Portuguese, Swedish, Spanish and Turkish. The message in English is: "haha i found your picture!"
If a user clicks on a link included with the message, a copy of the W32.Spyboot worm is automatically downloaded to their computer. Spyboot is a backdoor program that can, among other things, close security applications and help spread the worm further.
The Kelvir.HI worm affects computers running Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003 and Windows XP, according to a Symantec advisory available at www.sarc.com/avcenter/venc/data/w32.kelvir.hi.html.
In July, Akonix reported 42 new threats to IM systems, up 24 percent on the previous month.
Comments