A new worm spreading over IM networks is the first to check system settings in order to send a message in the appropriate language. The Kelvir-HI instant messaging worm is spreading over MSN Messenger's network, albeit modestly. IM security specialist Akonix classifies it as a low-risk threat.

The worm works by downloading a copy of the previous Spybot worm and tracking down the default language of a user, sending a message in either English, Spanish, Dutch, French, German, Greek, Swedish, Italian, Portuguese or Turkish. Once users click on the link in the message, a copy of the Spybot worm is automatically downloaded. Spybot is a backdoor program with backdoor functionality that surrenders control of compromised machines to hackers. ®

Related stories

Polyglot worm spreads over MSN (23 January 2008)
http://www.channelregister.co.uk/2008/01/23/polyglot_msn_worm/
Warezov worm fiends target Skype (28 February 2007)
http://www.theregister.co.uk/2007/02/28/warezov_skype_im_worm/
Hackers control bot client over P2P (2 May 2006)
http://www.theregister.co.uk/2006/05/02/nugache_worm/
Symantec acquires IMlogic (4 January 2006)
http://www.theregister.co.uk/2006/01/04/symantec_buys_imlogic/
Virus poses as MSN Messenger 8 (28 December 2005)
http://www.theregister.co.uk/2005/12/28/messenger_virus/
SDBot raises IM security concerns (2 November 2005)
http://www.theregister.co.uk/2005/11/02/im_security_concerns/
MessageLabs nabs Omnipod for IM security (2 November 2005)
http://www.theregister.co.uk/2005/11/02/messagelabs_buys_omnipod/
AOL IM worm roots around Windows PCs (31 October 2005)
http://www.theregister.co.uk/2005/10/31/aol_im_rootkit_worm/
IM worm hits Reuters (15 April 2005)
http://www.theregister.co.uk/2005/04/15/im_worm_runs_amok/
MSN Messenger worm seeds zombie networks (4 February 2005)
http://www.theregister.co.uk/2005/02/04/msn_messenger_bropia_worm/
Bofra exploit tied to 'massive botnet' (22 November 2004)
http://www.theregister.co.uk/2004/11/22/apache_hijack_serves_iframe_exploit/
Botched maintenance - not worm - blamed for MS IM glitch (12 October 2004)
http://www.theregister.co.uk/2004/10/12/funner_worm/