Originally published January 20 2006
Santa Claus worm invades instant messaging
by Mike Adams, the Health Ranger, NaturalNews Editor
According to a threat alert from IMlogic Inc., a new worm called IM.GiftCom.All is moving through instant-messaging networks. The message comes from someone on the user's "buddy list," and contains a malicious link.
The Santa Claus worm doesn't care whether you've been naughty or nice, but it's making a list of PCs to infect this holiday season, according to a threat alert released by security firm IMlogic Inc. today.
A new instant-messaging worm called IM.GiftCom.All is making the rounds this holiday season.
Rated as a "medium" threat by IMlogic, the worm attempts to get users of the instant-messaging networks run by America Online Inc., Yahoo Inc. and Microsoft Corp. to visit a seemingly festive Web site featuring Santa Claus.
The message comes from someone already present on a user's "buddy list," said Art Gilliland, vice president of products for IMlogic.
However, clicking on that link takes users to a different Web site and triggers the download of a malicious file to a user's PC, Gilliland said.
That file is created using rootkit techniques, making it extremely difficult to detect with conventional antivirus or operating system tools, he said.
Once resident on a system, the file tries to shut down antivirus software and collects personal information that can be redistributed over the Internet.
IMlogic has not recorded an instance where that personal information was actually sent out to the Internet, but the program does log information, Gilliland said.
Users are advised to avoid clicking on anything sent through an instant-messaging system unless they have verified that the file or picture is legitimate and the sender intended to pass it along, Gilliland said.
IMlogic recently identified an instant-messaging bot that produces canned assurances that a file is legitimate when the recipient replies to check its authenticity, so it's important to take extra care to verify the sender's intentions, he said.
All content posted on this site is commentary or opinion and is protected under Free Speech. Truth Publishing LLC takes sole responsibility for all content. Truth Publishing sells no hard products and earns no money from the recommendation of products. NaturalNews.com is presented for educational and commentary purposes only and should not be construed as professional advice from any licensed practitioner. Truth Publishing assumes no responsibility for the use or misuse of this material. For the full terms of usage of this material, visit www.NaturalNews.com/terms.shtml