Instant Messaging Worm

An instant messaging worm, reported by US firm IMLogic, has not been noticed in Australia.

Jakub Kaminski, a senior anti-virus researcher at Computer Associate's labs in the Melbourne suburb of Richmond, said the description provided by IMLogic indicated that the worm may actually be a bot.

"A bot would connect to a chat channel and then listen for orders," Mr Kaminski said.

According to the IMLogic advisory, the worm, which it has christened IM.GiftCom.All, broadcasts a URL over instant messaging clients such as AOL's AIM, Yahoo! Messenger, MSN and Windows Messenger.

An executable file, often named gift.com, is then downloaded and components of this file try to shut down anti-virus software and communicate with outside sources.

According to IMLogic, other components also try to log keystrokes and may attempt to propagate over IM clients.

Mr Kaminski said CA's labs had not received any samples of this malware yet but similar behaviour had been seen before.