AOL Instant Messenger worm harbinger of worse malware to come

By

Security experts have warned that a new generation of hybrid malware is being developed that targets Instant Messenger (IM) networks to propagate.

Chris Boyd, security research manager for Facetime Communications, explained to SC Magazine that although traditional IM malware has incorporated little more than ad software, next generation versions of this type of code was rapidly becoming more dangerous and malicious.


"Previously the authors only used ad software to make money. But now we are seeing much more malicious payloads. I personally believe that the adware is increasingly being used as a slight of hand to hide more malicious payloads," Boyd said.

The warning comes after a newly detected worm which incorporates rootkit malware was detected spreading through the AOL Instant Messenger (AIM) network.

The W32/Sdbot-ADD worm includes the lockx.exe rootkit file that connects to an IRC server, awaiting remote commands from an attacker.

Furthermore, the executable attempts to shut down anti-virus programs and leaves a backdoor on the host PC to install additional software.

Once installed the malware changes a viewer's original search page to http://www.eza1netsearch.com/sp2.php and often increases the CPU usage to 100 percent. It can also download other applications, including 180Solutions, Zango, the Freepod Toolbar, MaxSearch, Media Gateway, and SearchMiracle.

According to Facetime's Boyd W32/Sdbot-ADD is likely to be the harbinger of worse IM threats yet to come. "I think this is just a dry run for possibly more sophisticated attacks down the line. It is a Frankenstein threat that has taken lots to malware from other sources and bolted it all together," said Boyd.

"The next step at the moment is fully automated attack on IM. Previously a lot of attacks are spread in manual ways, but now it looks like we are beginning to see the malicious software authors meshing in more and more rootkits and Trojans.

All AIM PC users are potentially at risk from the exploit, which is being passed through instant messages from members on users' Buddy List and within AOL chat rooms, according to Boyd.

www.facetime.com/securitylabs/imp2pthreats.aspx

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, US edition
Tags:

Most Read Articles

NSW Police to embark on $126m IT overhaul

NSW Police to embark on $126m IT overhaul

CBA looks to GenAI to assist 1200 'security champions'

CBA looks to GenAI to assist 1200 'security champions'

Victoria's first government tech chief steps down

Victoria's first government tech chief steps down

WhatsApp banned on US House of Representatives devices

WhatsApp banned on US House of Representatives devices

Log In

  |  Forgot your password?