Spying worm spread by MSN Messenger, AIM
The latest threat is a Trojan called Kirvo which arrives in the form of an Instant Message from someone on the user's 'friends' list. The message contains a link to a Web site, which if clicked on, loads a copy of Kirvo on the computer. Kirvo is pre-programmed to then fetch a copy of Spybot, which is a dangerous worm that can take advantage of software vulnerabilities to spy on the user.
Tim Hartman, systems engineer director of Symantec in Asia Pacific and Japan, said Kirvo worked in tandem with Spybot and the malware author's zombie army to seek out and infect more computers.
"All [Kirvo] does is take advantage of the user -- by enticing him/her to click the link and launch the trojan. Once launched attempts to download a variant of Spybot, which is a true worm that takes advantage of several vulnerabilities. Kirvo appears to have been developed to assist SpyBot propagation and increase the army of Spybot zombies on the Internet," said Hartman.
Alan Bell, marketing director for antivirus firm McAfee, said that the criminals responsible for Kirvo and Spybot have law enforcement authorities chasing phantoms by using compromised computers to supply copies of the worm over automated redirection services.
"If you are on a link where your IP address is changing all the time -- like dial up and to a lesser extent, broadband -- you can register with a service that keeps track of your IP address. As your IP address changes requests can be redirected. If the authorities chased up that IP address they would probably find some company that makes pots and pans that has a zombie computer," said Bell.
Spybot is one of the most prevalent worms on the Internet, according to Bell, who said that a recent report from McAfee found that bot activity had increased more than 300 percent between the first and second quarter of this year.
"The number of bot related cases increased by 303 percent from Q1 to Q2. It has gone from 3,000 cases to just under 13,000 cases and SdBot (McAfee's alias for Spybot) is one of the top four of the bot families. There are tens of thousands of variants out there," said Bell.