Multilingual MSN Messenger Worm Spreads

Users of Microsoft's MSN Messenger should be aware of a new "smart" worm that checks the configuration of their Windows client and sends a message in the appropriate language, according to security companies Akonix Systems and Symantec.

Both companies published alerts this week.

The Kelvir.HI worm, a variant of the Kelvir IM malware that surfaced earlier this year, appears to be the first instant-message bug capable of checking systems settings and communicating in the victim's native tongue.

Sending Its Message

When the worm penetrates a system, it sends a message in one of several languages, including Dutch, English, French, German, and Greek as well as Portuguese, Swedish, Spanish, and Turkish.

The message in English is: "haha i found your picture!"

If a user clicks on a link included with the message, a copy of the W32.Spyboot worm is automatically downloaded to their computer. Spyboot is a backdoor program that can, among other things, close security applications and help further spread the worm.

The Kelvir.HI worm affects computers running Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, and Windows XP, according to a Symantec advisory.

In July, Akonix reported 42 new threats to IM systems, up 24 percent over the previous month.