New AIM Worm Dupes iTunes Fans

[Jeff]

A new worm has been discovered on the AOL Instant Messenger service that dupes users into thinking it is a file for the popular iTunes music player software. The worm appears in an IM with the message "this picture never gets old" and a link to what appears to be an image URL. However, it is not an image and is rather an executable file called "iTunes.exe" which will install several spyware applications including "Internet Optimizer," "Media Ticket," and "180 Search Assistant."

Trend Micro, which discovered the worm and issued a warning about it, said that the file also opens a "backdoor" allowing hackers to send commands to the computer from an Internet Relay Chat (IRC) chat room. The hackers could download or execute files on the machine as well as send AIM messages to other users on the infected user's buddy list. The worm affects all versions of Microsoft Windows.

Source: BetaNews

[mauro]

Messenger:Mate for AIM (www.messengermate.com) protects you against this type of stealth URL by warning when you click on links that point to potentially dangerous file extensions giving you the ability to stop it before it even downloads.

[Jeff]

Frankly, this is another one of those worms that anyone with an ounce of common sense (and a dash of experience) can easily side-step. There is no real concern here, unless you make a habit of nonchalantly clicking links that people send you without asking what it is and confirming that they really sent it to you.

Here's what I do. When someone sends me a link, I first ask... "what is this?" If it's from someone that I barely know, I probably won't click it anyway, but that simple question can thwart a whole lot of worm headaches.

[mauro]

Jeff, I agree completely because like you I'm an experienced user. I was asked to add that feature to Messenger:Mate for the less experienced users, the ones that click blindly on every link. I'm suprised it's not a standard feature of AIM as it's relatively simple for them to add.