05 September 2006, 09:30

MSN worm doing the rounds

A variant of the Braban instant messenger worm has recently starting sending itself to MSN contacts. The worm sends text messages containing a link, in the hope that innocent users will download the file, which purports to be a photo of the recipient. Only around half the virus scanners tested by Virustotal currently detect this malware.

No one has yet analysed the effects of this worm, christened "Braban.h" by many anti-virus software manufacturers. Descriptions of its predecessors are also rather thin. According to Sophos, Braban-A simply sends text messages with links to further contacts. It is, however, possible, that Braban.h contains additional damaging routines. Norman sandbox, for example, detects that the malware connects to a server on port 80.

Instant messenger users should block messages from unknown contacts, if their software offers this kind of filter. Should such a message slip through despite this, the user should not follow the attached link. Otherwise they run the risk in the future of installing a backdoor or trojan.

(ehe)

« previous | next »

Print Version | Send by email | Permalink: http://h-online.com/-731442