Instant messaging has become increasingly popular lately. Programs like MSN Messenger, Yahoo! Messenger, AIM, etc, are more and more used as a means of communication among users. However, these programs can pose a threat to users due to the possibility of sharing files, folders, or even entire disk drives.

“Malware creators have found an open door in these tools to distribute their creations to an incredibly large number of computers. To this end, they use social engineering techniques to try to trick users into downloading malicious codes”,

A message claiming to contain some photos is the most common way of spreading this type of malware. It is easy for trusting users to accept and open these files, downloading malware onto their computers.

Addon.B and MSNPoopy.A have been the latest examples of worms designed to spread through these platforms. The first one uses MSN Messenger to send out a .zip file called Foto_celular. Once the file is run by the victim, it downloads the second component of the worm, called sexy.wm. MSNPoopy.A uses texts like “look @ my cute new puppy :-D” or
”look @ this picture of me, when I was a kid “ to  entice users into opening the attached file, which has names such as img1756 and is also compressed in .zip format.

“Another example of malware that has used this type of program is MSNDiablo.A. This specimen included a link which supposedly allowed users to view a series of animations of George W. Bush. However, the link actually downloaded a Trojan”, says Corrons.

Due to a wide use of this type of malware distribution techniques, PandaLabs has prepared a series of tips for using instant messaging programs correctly.

First, do not click any links or download files that come from unknown sources. If the file or link does come from a known contact, make sure the contact is actually sending you the files and it is not some kind of automatic message generated by a malicious code. Ask the contact about the files that they wanted to send you.

Always use secure passwords. The longer the password and the more various the characters it contains, the more secure it will be. Mixing letters and numbers and using capital letters is a good way of making passwords safer.

Never reveal personal or confidential information in chats.  This is particularly important in corporate environments, as a company’s confidential data are a primary target for cyber-crooks. Also, if you are using a public computer, be careful to disable the automatic sign-in option. This way, we will prevent other users from having free access to your instant messaging accounts.

Entering your email address in a public place is a way to provide cyber-criminals with one more address to send spam to, as well as a possible target for their malicious codes. Be careful not to disclose your email address unnecessarily.

Finally, be particularly careful with children’s usage of these programs as it is not only malware that they might be exposed to, but also they might get in contact with inappropriate or dangerous people.

To protect themselves, home users and companies must use latest-generation anti-malware solutions and keep them updated. Panda Security has a complete range of solutions that protects from these risks both for home and corporate environments.

All users that want to know whether their computers have been attacked by these or other malicious code can use TotalScan or NanoScan beta, the free, online solutions available at: http://www.infectedornot.com.