ADVISORY/IMlogic Threat Center reports W32/Kelvir-Re impacting Reuters Messaging network; offers immediate guidelines for protection.

Please replace the release from April 14, 2005 with the following corrected version.

The corrected release reads:

ADVISORY/IMLOGIC THREAT CENTER REPORTS W32/KELVIR-RE DETECTED ON REUTERS MESSAGING NETWORK; OFFERS IMMEDIATE GUIDELINES FOR PROTECTION

WHAT: Industry leader IMlogic is warning customers that a variant of the W32/Kelvir-Re worm has been detected on the Reuters Messaging network. The worm distributes instant messages containing a URL link pointing to a Web site which may contain infected software. In an effort to protect its customers and prevent Reuters Messaging from being used to propagate this worm, Reuters has temporarily suspended its Reuters Messaging service. The Kelvir-Re worm is a variant that has targeted MSN and Windows Messenger clients, but has previously not bridged to the tightly controlled network of Reuters messaging.

The worm is intended to convince users to download an executable program using social engineering techniques. The worm sends users a benign message (such as "is it you?"). Users who click the link will have their Web browser open and redirected to the infected Web site. Once there, the Web site will try to download the infecting software. If the user chooses to download and run the software then they become infected.

Once executed, this worm will send similar IM messages to the online contacts of an infected user's contacts list. A list of malicious URLs associated with W32/Kelvir-Re is provided by the IMlogic Threat Center.

Customers using security products such as IMlogic IM Manager(TM) to securely protect and filter IM messages would not be affected by this worm/virus. Customers that run firewall security software that prevents downloading malicious executables are also protected. All customers are advised to ensure their Anti-Virus software is up to date. Reuters recommends that customers block the infected Web site "hydr0.net" and that end-users not open suspicious executable programs downloaded from the Internet.

To learn more about the W32/Kelvir-Re worm visit the IMlogic IM and P2P Threat Center at: http://www.imlogic.com/im_threat_center/index.asp.

For companies not currently using IMlogic's IM Manager to securely protect and filter IM messages, a free downloadable product released from IMlogic - IMlogic IM Detector Pro - can be used to immediately block IM traffic and stop the potential for spreading this worm. Companies can download IM Detector Pro at no cost directly from IMlogic's Web site at www.imlogic.com/imdetectorpro. A helpful install wizard simplifies the process and guides users through each step.

MORE INFO: Learn more at IMlogic's Threat Center: http://www.imlogic.com/im_threat_center/index.asp.

Disclaimer

The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.

IMlogic, IMlogic products and IMlogic IM Manager are trademarks of IMlogic Corporation and/or affiliated companies in the United States and other countries. All other registered and unregistered trademarks represented in this document are the sole property of their respective companies/owners.