Windows Live Messenger ads serve up malware

Microsoft's messaging client for several days has displayed banner ads that attempted to install malware on user's systems.

Microsoft has acknowledged the incident and has removed the offending advertisements.

"We apologize for the inconvenience and are reviewing our ad approval process to reduce the chance of an occurrence such as this happening again," Whitney Burk, a PR manager with Microsoft said in an emailed statement.

The banners inside the Windows Live Messenger advertised Errorsafe, an application that claims to detect and repair computer problems. The software is notorious because it often gets installed without the user's permission and because it presents false security warnings that are intended to make the user purchase a licensed copy of the software.

Most security vendors list Errorsafe and related software such as Winfixer as a potentially unwanted program or a security risk.

"This is very bad news for users of MSN Messenger, and for MSN and Microsoft, " Sandi Hardmeier, a Microsoft 'MVP' wrote on her Spyware Sucks blog.

Security experts in the past have pointed to banner advertisements as a potential way to distribute malware and exploit software vulnerabilities. They offer malware authors a potential way to post their attack code on trusted, mainstream websites.
The Windows Live Messenger incident further confirms the risk of such attacks.

"I am struggling to express how upset, and disappointed, and worried, I am that this has happened. For years I have been holding up MSN Messenger banner advertisements as an example of how advertisements can be safely served up to end users without putting them at risk of malware."

"Now, everything has changed. Users have been put at direct risk through no fault of their own and they can't avoid the MSN banner advertisements when the contact pane is open without using a third party hack that is ethically wrong to use," Hardmeier concluded.

Copyright ©v3.co.uk

livemalwaremessengersecurityserveupwindows