A new worm detected as WORM_IRCBOT.SN is currently making its rounds via MSN Messenger. In some instances, it drops popular social networking sites’ names MySpace and Facebook as it spreads itself. It sends any of the following messages together with a link where the picture referred to in the messages can be “viewed” by its recipients:
- can i throw this picture of you and me on myspace?
- Wanna see my pictures before i send em to facebook?
- can I throw this picture of us on my facebook.. please?
- I think this picture is terrible. but my friends on myspace want to see it. please dont show noone.
- do I look dumb in this picture? I want to put it on myspace.
- do you think I look ugly in this pic? its one of my new ones too
- hey i found your picture on hotornot.com! I swear its you!
- OMG, i found ur pic on cuteornot.com! im not kidding either!!!
- jesus this person really looks like you!
- This picture isnt you… right? lol
This is only a partial list; it has a lot more lines that are mostly talking about photos. Another interesting thing about this worm, as observed by our senior analysts, is that the messages change according to the language of the affected operating system used. Based on the ploys used (using the MySpace and Facebook names and having references to country codes in its registry) as well as the varying languages by this localizing MSN worm, its authors are trying to capture a wide audience.