Users of Microsoft Corp.’s MSN Messenger should be aware of a new “smart” worm that checks the configuration of their Windows client and sends a message in the appropriate language, according to security companies Akonix Systems Inc. and Symantec Corp. Both companies published alerts on Wednesday.
The Kelvir.HI worm, a variant of the Kelvir IM malware that surfaced earlier this year, appears to be the first instant-message bug capable of checking systems settings and communicating in the victim’s native tongue.
When the worm penetrates a system, it sends a message in one of several languages, including Dutch, English, French, German and Greek as well as Portuguese, Swedish, Spanish and Turkish. The message in English is: “haha i found your picture!”
If a user clicks on a link included with the message, a copy of the W32.Spyboot worm is automatically downloaded to their computer. Spyboot is a backdoor program that can, among other things, close security applications and help further spread the worm.
The Kelvir.HI worm affects computers running Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003 and Windows XP, according to a Symantec advisory at this Web site.
In July, Akonix reported 42 new threats to IM systems, up 24 percent over the previous month.