MSN Messenger Worm Spreads

Security experts now say the worm poses a medium threat.

Scarlet Pruitt, IDG News Service

Security experts have raised the warning level on a worm that spreads via Microsoft's MSN Messenger, in an effort to slow its crawl through Taiwan, Korea, China, and the U.S.

The Bropia.F worm, a variant of the Bropia.A worm detected last month, was raised to a medium-risk threat this week by antivirus firm Trend Micro.

The worm propagates by sending a copy of itself under different file names--including "bedroom-thongs.pif", "hot.pif," and "naked-drunk.pif"--to all available or online contacts on an infected user's MSN Messenger list.

It also sends and executes a file titled "sexy.jpg", which carries the image of a headless, plucked chicken sunbathing, replete with pronounced bikini tan lines.

Protect Yourself

Trend Micro recommended that MSN Messenger users block file transfers to slow the worm's spread.

The variant also attempts to drop and execute a bot program, which tries to copy itself into network shared folders and has an antidebugging feature, Trend Micro says. The worm will not run on an infected system if the NT-ice and Softice debugging applications are running.

Additionally, the worm attempts to lower the volume on infected users' machines so they cannot hear audio security threat warnings, according to the antivirus company.