AOL Instant Messenger worm harbinger of worse malware to come

Chris Boyd, security research manager for Facetime Communications, explained to SC Magazine that although traditional IM malware has incorporated little more than ad software, next generation versions of this type of code was rapidly becoming more dangerous and malicious.

"Previously the authors only used ad software to make money. But now we are seeing much more malicious payloads. I personally believe that the adware is increasingly being used as a slight of hand to hide more malicious payloads," Boyd said.

The warning comes after a newly detected worm which incorporates rootkit malware was detected spreading through the AOL Instant Messenger (AIM) network.

The W32/Sdbot-ADD worm includes the lockx.exe rootkit file that connects to an IRC server, awaiting remote commands from an attacker.

Furthermore, the executable attempts to shut down anti-virus programs and leaves a backdoor on the host PC to install additional software.

Once installed the malware changes a viewer's original search page to http://www.eza1netsearch.com/sp2.php and often increases the CPU usage to 100 percent. It can also download other applications, including 180Solutions, Zango, the Freepod Toolbar, MaxSearch, Media Gateway, and SearchMiracle.

According to Facetime's Boyd W32/Sdbot-ADD is likely to be the harbinger of worse IM threats yet to come. "I think this is just a dry run for possibly more sophisticated attacks down the line. It is a Frankenstein threat that has taken lots to malware from other sources and bolted it all together," said Boyd.

"The next step at the moment is fully automated attack on IM. Previously a lot of attacks are spread in manual ways, but now it looks like we are beginning to see the malicious software authors meshing in more and more rootkits and Trojans.

All AIM PC users are potentially at risk from the exploit, which is being passed through instant messages from members on users' Buddy List and within AOL chat rooms, according to Boyd.

www.facetime.com/securitylabs/imp2pthreats.aspx