December 6, 2005 5:43 PM PST

New IM worm chats with intended victims

Related Stories

Study: IM worms up again in November

November 29, 2005

AIM worm plays nasty new trick

October 28, 2005

IM worm speaks your language

August 24, 2005
You can now instant message with a worm.

A new worm that targets users of America Online's AOL Instant Messenger is believed to be the first that actually chats with the intended victim to dupe the target into activating a malicious payload, IM security vendor IMlogic warned Tuesday.

According to IMlogic, the worm, dubbed IM.Myspace04.AIM, has arrived in instant messages that state: "lol thats cool" and included a URL to a malicious file "clarissa17.pif." When unsuspecting users have responded, perhaps asking if the attachment contained a virus, the worm has replied: "lol no its not its a virus", IMlogic said.

The malicious file disables security software, installs a backdoor and tweaks system files, the company said. Then it starts sending itself to contacts on the victim's buddy list.

But the worm is programmed so that the infected user cannot see the messages that are being sent out by the worm, according to IMlogic.

"This is a first," said Andrew Burton, director of product management at Waltham, Mass.-based IMlogic. This worm is not widespread, but attackers are just trying out this new technique, he said. "We will see one or two instances of an attack, there will be a refinement and then there will be an outbreak."

The inclusion of an IM bot is another sign that IM worms are becoming more sophisticated. Another worm, also spotted on Tuesday, takes a more traditional route: it spreads under the guise of a holiday greeting card, IM security specialist Akonix Systems said Tuesday.

The holiday worm, dubbed Aimdes.E, targets AIM users and arrives with the message: "The user has sent you a Greeting Card, to open it visit:" followed by a link. Once the target clicks on the link, the worm installs itself on the system. It opens a backdoor on the computer and sends itself to contacts on the buddy list, Akonix said.

Advice to users is to be careful when clicking on links in IM messages--even when they seem to come from friends--and to use up-to-date antivirus software. When receiving a link in an instant message, the best practice is to verify with the sender if the link was sent intentionally or not.


Join the conversation!
Add your comment
haha, thats smart
poor windows aol users! they get picked on so bad
Posted by digitallysick (103 comments )
Reply Link Flag
Are you 5?
you are so childish. Don't act like it's another kick in the mouth for Window users. Only reason why there are so of these stupid viruses are because MS is so widely spread. It's not going to go after a small percentage of users then what the heck is the point of making the virus in the first place. They do it so it spreads in a large lump not the small percent of MAC and other users.
Posted by Carmen89 (6 comments )
Link Flag
This is NOT the first im virus to "talk back"!!
I had a yahoo messenger virus do almost exactly the same thing in 2003!! The only difference was that it never told people that it wasnt a virus. What it did say was things like "lol! hey check out this link" and other stuff.. IT got to the point I had to tell people "dont click that, I didnt say that!"... It was a nasty virus that was not listed anywhere. I had to fdisk and format my drive to kill it. So, this is NOT the first time a virus of this nature has been discovered. But, I dont think the virus I found was ever flaged by a anti-virus program.
Posted by Digital_Freedom (8 comments )
Reply Link Flag
You missed the point
There's been lots of viruses/worms/etc that have used IM to spread. And many of them do exactly what you described, send every contatct on a victims list a message that says, 'Check this link' or 'this is cool'. This one does exactly that, however, if a user types a response to the victim, the WORM prevents the victim from seeing the message and the WORM responds to the user. This is very different from what you described.
Posted by noname976431 (1 comment )
Link Flag
Think how nasty they could get...
Just think, these things could read through a user's history files to pick out any type of confirmation that you may currently be using to verify that the links your friends are sending you are sent on purpose. Personally, I think I'm done clicking links through IM.
Posted by cparks0225 (1 comment )
Reply Link Flag
I think it's just smart to banish clicking links for good. If it's that important they can find another way to inform you on whatever it is they want to show you.
Posted by Carmen89 (6 comments )
Link Flag
How about clicking this link?
Here is the scariest virus site yet.

<a class="jive-link-external" href="" target="_newWindow"></a>

Use MS Windows. Live in fear.
Posted by cyber_rigger (70 comments )
Link Flag
Too Dang Funny - I wonder where the proofreader is today
From the article: "When receiving a link in an instant message, the best practice is to verify with the sender if the link was sent intentionally or not."

Of course, the worm will reply "lol no its not its a virus"
Posted by (5 comments )
Reply Link Flag
What OS?
I know this is probably for Win2K/XP, but since AOL Instant Messenger is also available for Win98/Me, Mac OSX, and Linux, your article should probably specify.
Posted by flangeku (1 comment )
Reply Link Flag
re: WHAT OS?
Many c|net virus/worm articles either don't mention the affected OS, or bury it later in the story after how the virus/worm affects the user.

This is, simply, bad journalism writing.
Posted by NickEP (11 comments )
Link Flag
It's a .pif file

the're old DOS (Windows 3.1) shortcut files.
they can have all kinds of virus code put in them, and because you never see them anymore, be weary of one that someone, or something, wants you to download.
Posted by aonfiek (1 comment )
Link Flag
Well I read all the post. Hmmm...Run out and buy and buy Linux or Mac and learn how to use those. Not today but thanks for the suggestion.

Hmm...Make up stories Think even if they are made up I would want the information. Thankyou Cnet.

Hmm...Links in the IM cause the problem. Don't type the whole string (link) to another user. instead of <a class="jive-link-external" href="" target="_newWindow"></a> type yadayada let them type the string. ignore the bots see who is really in the room. watch it for a bit and you will be able to tell.

Like my windows. Keepin it.

Posted by Eskiegirl302 (82 comments )
Reply Link Flag
Re: Worms
Honestly, that sounds like a very good idea to just send part of the string (link), but if you are trying to show someone a webpage that you made through a website, such as angelfire, geocities, or myspace, then they are going to need more that just part of the string.
Posted by fairyboi17 (1 comment )
Link Flag
Typical Windoze mentality
Eskie, I don't doubt that you had a tough time learning to deal with
Windoze, and you naturally think that learning another OS would be
just as difficult, but it's not.

Most switchers are surprised at how much easier the Mac is. Often,
the only thing stopping them from trying things on their Mac is the
fear they brought with them from Windoze. Once they get over
that, it's smooth sailing, and without viruses &#38; spyware.
Posted by Macsaresafer (802 comments )
Link Flag
How foolish do you have to be to actually fall for that? Wouldn't you realise that it isn't your friend and wouldn't you first check the link location to see what it is?

if you like taking the long way:
-right click
-copy shortcut
-paste to desktop
-right click &gt; properties

...that was tough.
Posted by Teome (1 comment )
Reply Link Flag
AIM in general
I've always found it strange that if one installs or even just runs the executable for AIM, it immediately makes it so if you block using the hosts file, it does no good--it still lets you go go I wonder what they're doing that lets them bypass the hosts file. Since the whole sony thing, I've been wondering whether there's something not-so-cool going on with AIM.
Posted by Kizzume (3 comments )
Reply Link Flag
There's a difference here.
The problem we're ignoring is that while the idea that clicking a link from someone sending you an obsolete filetype, who's typing like an idiot would be ridiculous to folk like US, There are piles upon piles of people who can't tell a good AV program from their anus. That said, It's unlikely that any of the readers on this website would even think about clicking links which are so blatantly obvious in their virus-hood(?).

Trojans these days are so widespread that it seems unlikely that they're even meant for malicious purposes anymore, so much as they are meant for seeing just how widespread you can make your virus go. Certainly, it makes the system of everyone it infects more vulnerable, but unless the person who creates the virus has a primary plan to actually send out something that will HURT your computer, it's not really worth worrying about the worm. Of course if you get it, you should remove it, and you should be taking necessary precautions to keep from getting it in the first place through use of common sense (as with this one, since obviously a .pif file is one of the least likely to be safe files around...) Or through the use of a good Antivirus program.

Unfortunately not everyone is quite so able to exercise common sense, so here is an easy to remember maxim for those people:

If you don't know how to use your computer effectively, Don't use it.

Computers don't work on their own. They are tools like any other. If your car breaks down, you have to get it fixed. If you computer breaks down, it will not fix itself. Know how your computer works, otherwise I can't be bothered to care when your computer stops working, and you don't know why.
Posted by Haterabbit (1 comment )
Reply Link Flag
They harm you, not your computer
Rab, be careful. A lot of malware isn't intended to cause a computer
problem. They want your computer to keep working, but for them.
They can send back all your keystrokes, including those from what
you thought was secure banking. They can use your PC for sending
out junk mail and kiddie porn. These things can all create big
problems for you, and without hurting your computer at all.
Posted by Macsaresafer (802 comments )
Link Flag
First time?
"The inclusion of an IM bot is another sign that IM worms are becoming more sophisticated."

These techniques have been floating around the Web for years. Back when I used ICQ in 1999, IM Bots sent me porno links all the time, so much I've never used ICQ since then. Also, the technique that only the message reciever sees the message is not new. Last year a friend of mine kept sending me messages with a strange URL, and when I asked him about it, he said he didn't know anything about it.

Both techniques are highly intrusive, but old. They have been used for malicious purposes for years. So why is it only now in the news? The fact that the links installs a Trojan may be the new catch, but it was only a matter of time.
Posted by Sentinel (199 comments )
Reply Link Flag
I was going to guess....
that this only affected Windoze systems since they're so easily
defeated. Then I thought it would be better to check it out.

According to Trend Micro it affects: Windows 98, ME, NT, 2000, XP,
Server 2003

Will people never learn?
Posted by Macsaresafer (802 comments )
Reply Link Flag
LOL windoze!!!@
Grow up.
Posted by Christopher Hall (1205 comments )
Link Flag
How about Gaim?
If a user on a Windows platform was using Gaim (<a class="jive-link-external" href="" target="_newWindow"></a>), would this IM worm be able to accomplish the same task as a Windows/AIM user? I would imagine that the worm may be able to install itself but might not be able to forward itself to all of your buddies. In this regard, using an IM program such as Gaim might be an attractive choice for windows users.

Posted by Ron Ammerman (1 comment )
Reply Link Flag
Does it support file transfer?
I don't think you can make a folder available for sharing in GAIM, like you can using AIM. Thats my only gripe. Developers are working on it though, and as soon as they include this feature I will switch immediately. I hate how AOL installs all that extra software including their browser, media player, and the rest of the garbage. Then they change your registry to make them all start on system startup. AIM is a memory and cpu hog. I can't wait to get rid of it. Anybody else use any other AIM alternatives?
Posted by stealt403 (48 comments )
Link Flag
Another Windows vs. Mac battle?
This argument is getting old. It seems like every new story on cnet about a virus or worm leads to this type of discussion. I think mac users should continue to think they are better than everyone else and keep their mouth shut. Windows users should be more cautious as always and keep virus definitions current. I don't think either side will ever convince the either that they are right and switch OSs. People are self-righteous. I have nothing against mac or windows users.
Posted by stealt403 (48 comments )
Reply Link Flag
NOT THE FIRST- Cnet is wrong here!
I agree.I actually had a yahoo messenger worm that did almost exactly the same thing in 2002-2003! The only difference was thatyou could read what the virus said to the victim (could read the "lol, cool.. check this link out" etc..) CNET: PLEASE DONT CALL THIS WORM THE FIRST THAT CHATS WITH A VICTIM TO DUP THEM TO CLICK A VIRUS INSTALL LINK. It's simply NOT TRUE.
Posted by Digital_Freedom (8 comments )
Reply Link Flag

Join the conversation

Add your comment

The posting of advertisements, profanity, or personal attacks is prohibited. Click here to review our Terms of Use.

What's Hot



RSS Feeds

Add headlines from CNET News to your homepage or feedreader.