Polyglot IM worm targets MSN

[Osiris]

A new worm spreading over IM networks is the first to check system settings in order to send a message in the appropriate language. The Kelvir-HI instant messaging worm is spreading over MSN Messenger's network, albeit modestly. IM security specialist Akonix classifies it as a low-risk threat.

The worm works by downloading a copy of the previous Spybot worm and tracking down the default language of a user, sending a message in either English, Spanish, Dutch, French, German, Greek, Swedish, Italian, Portuguese or Turkish. Once users click on the link in the message, a copy of the Spybot worm is automatically downloaded. Spybot is a backdoor program with backdoor functionality that surrenders control of compromised machines to hackers.

 

[Static_11]

ouch... do you know what message it is?

 

[Osiris]

Akonix security center has detected and identified a new worm which travels through instant messaging programs.

The worm, named Kelvir.HI is the first in the history of wormery that intelligently checks system settings of an IM client and sends a message in the appropriate language, says Akonix. Not to worry though, this worm's classified as low risk so if you keep your wits about you, you should be alright.

Kelvir.HI works by downloading a copy of the W32.Spybot worm, then working out the native language of a system before sending a message in either English, Spanish, Dutch, German, Swedish, Greek, French, Italian, Turkish or Portuguese. If a user clicks on the link in the IM a copy of spybot is launched through the realms of the internet and directly onto their computer. Spybot is a backdoor worm that can end security applications, operate the PC from afar and log keystrokes.

 

[Static_11]

ewwww that sounds nasty... but they classify it as low risk when they can keylogg you.... riiiiight....

 

[C0RR0SIVE]

>_< This is why i never EVER click on links unless me and a friend are talking about certain sites and i ask for the link..................