Feeds

MSN Messenger worm seeds zombie networks

Roast chicken with a bikini tan line

  • alert
  • submit to reddit

Providing a secure and efficient Helpdesk

A worm spreading via MSN Messenger is turning infected Windows PCs into zombie drones. The Bropia-F worm spreads by offering "sexy image files" to IM contacts of infected users.

Instead of racy documents, users who accept and open infected files get a comical photo of a roasted chicken with a bikini tan line. In the background, Bropia-F installs a variant of the infamous Agobot (AKA Pahtbot or Rbot) worm, opening a backdoor on infected systems. The bot can then be used to collect system information, log keystrokes and relay spam.

"Many corporations have been blocking use of instant messenger programs for employee productivity reasons, and now may have good cause to do so for security reasons as well," said Joe Hartmann, senior virus researcher at anti-virus firm Trend Micro. "With the popularity of instant messengers, it may be the home users who are most at risk - this kind of worm uses humour to make people forget that they are being infected and backdoors are being opened into their systems."

Bropia-F arrives in a file about 184 KB in size. It tries to spread to other MSN Messenger users by sending a copy of itself under one of these filenames: bedroom-thongs.pif, hot.pif, lmao.pif, lol.scr, naked_drunk.pif, new_webcam.pif, rofl.pif, underware. pif and webcam.pif.

Sightings of the worm have been reported in Taiwan, China, Korea, Costa Rica and the US since it began spreading earlier this week. Anti-virus firms rate the worm as a medium risk.

Users are also advised to apply the principles of safe computing and to exercise caution in the programs they allow to self-install on their PCs. Windows users are also advised to update their antivirus signature files to detect the worm, just in case. ®

Related stories

Instant message, cracker tricks
Messenger users get Henpecked
MSN Messenger worm entices the unwary
First MSN Messenger virus

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Hackers thrash Bash Shellshock bug: World races to cover hole
Update your gear now to avoid early attacks hitting the web
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.