CyberLogic Blog

Kaspersky Labs have announced the detection of a new family of worms that spread through Instant Messaging applications. What makes this worm highly unusual is the fact that it is multilingual and can infect multiple Instant Messengers (IM) simultaneously.

The IMs used by this worm include Yahoo Messenger, Skype, Windows Live Messenger, Google Talk, Paltalk, ICQ and the Xfire client. There are currently 4 variants of this worm which has been named IM-Worm.Win32.Zeroll. Once it penetrates a computers security, it searches for installed IM programs and then sends itself to all the addresses in the contact lists.

The worm has a backdoor functionality that allows it to gain control of a computer without the user’s knowledge. Once infected, it will connect to a remote command centre and receive instructions via IRC to start downloading other malicious software. Kaspersky say this new breed of worm connects to different IRC channels depending on the country and the infected application.

Infection happens when a user clicks on a hyper-link to what they believe to be a picture, but instead a malicious file is opened. Because this work is multilingual, using 13 different languages, it can send messages to users in different countries, in a language they will understand.

The majority of the infections so far have been in Brazil, Mexico, Peru and the USA. However, many instances have been recorded in Africa, India and some European countries. Users are urged not to open attachments via IM without confirming the validity of the file with the sender.