Trend Micro today issued a medium risk alert for a worm which spreads using MSN Messenger. The worm, which is a variant ot the Bropia worm, lures users with promises of sexy images, but if a user downloads the link all they get is a photograph of a roast chicken with a bikini tan line. No one ever said virus writers don't have a sense of humour.
Less amusing is the other part of the payload. As well as attempting to send itself to all of a users contacts on their MSN Messenger list, the worm installs the Agobot.AJC worm on a users system. This worm opens a backdoor onto the users machine, and is also able to steal various CD keys from applications, as well as the Windows Product ID.
The filenames that the worm attempts to propagate with are as follows:
Bedroom-thongs.pif
Hot.pif
LMAO.pif
LOL.scr
Naked_drunk.pif
New_webcam.pif
ROFL.pif
Underware. Pif
Webcam.pif
The file is usually around 184KB in size. All Windows platforms from Windows 95 to XP are vulnerable, without the latest in virus protection running. As always we'd recommend you don't accept files from any untrusted source unless you are certain of their content, be they in e-mail attachment form or any other form. Also, ensure you keep your anti-virus and operating system patches as up to date as possible.