Fanatic Live

An entry on security company F-Secure’s weblog warns that a Web site claiming to offer an unreleased beta of MSN Messenger 8 is actually spreading a worm.

The site, located at msgrbeta8.com, was registered on December 24. It isn’t currently responding. According to F-Secure, “If you download and run BETA8WEBINSTALL.EXE from that site, you won’t get a new chat client. Instead, your existing MSN Messenger will start to send download links to everyone in your contact list. It also connects your machine to a botnet server.”

The entry also provides some information on identifying IM traffic from an infected system: “The download link always contains the recipients’ email address. For example, if you’d have a friend with email address huuhaa@foobar.com, he would get a download link like msgrbeta8.com/im.php?msn=huuhaa@foobar.com.”