IM worm lures users to the dark side

May the force be with you

Iain Thomson, vnunet.com 31 May 2005

Users of AOL and Yahoo instant messaging clients have been bombarded with a phishing attack that plays on the current interest in Star Wars.

Yahoo users have received messages urging them to try out an online Star Wars game, but are directed to a phishing site which tries to steal log-in details.

AOL users have also received a URL in instant messaging spam, with the header 'hehe i found this funny movie'. Clicking on the link downloads a Trojan known as Funmov.a, which allows remote control of PCs via IRC channels.

Warnings have also been received about a new MyTob variant that uses IRC channels to remotely control PCs. MyTob uses a combination of two previously known viruses, Mydoom and Sdbot.worm, and has been rated as a growing problem by security companies.

"TrendLabs has declared a medium risk alert in order to control the spread of worm_mytob.ar," said the company in a statement.

"TrendLabs has received several infection reports indicating that this worm is currently spreading in Australia, China, Hong Kong, India, Japan, Korea, The Philippines, Taiwan and the US."

The worm comes as an email attachment claiming to be documents about the user's email account. When clicked the code installs itself on the PC as 'Lien Van de Kelder.exe', harvests email addresses and sends itself on using its own SMTP engine.

Signature files for the new code have been prepared and are already available from antivirus vendors.

See also: