By: David A. Utter

Reprinted By: Erich Toven

Users of instant messaging systems MSN, AIM, ICQ, and yahoo could get smacked with a worm that entices people to click on a link to santa claus.

This gift is one you'll wish you'd never opened. The IM.GiftCom.All worm arriving by those IM systems or over Windows Messenger apears to be a URL linked to a picture of Santa Claus. IMLOgic, which discovered the worm, posted that clicking the URL launches an executable file.

Once the file gets started, it embeds itself into the PC as a rootkit, and scans the registry, file system, and Internet cache.

IMLogic also said the proces hides from antivirus and other system tools that might detect it. The worm also logs keystrokes and may also try to spred itself to other users over IM to usernames it grabs from those services on the infected PC.

While its method of distribution dosen't make it a big threat, the amount of damage it can do to a system caused IMLogic to rate it as a medium threat, a company executative told CNet news.

Users and administrators should ensure they are running the most current versions of their antivirus engines and that signature files have been updated to help repel the threat. Also, people will want to be carful about clicking on links in messages that arrive unexpectedly. Even if they appear ti be from a legitimate messaging buddy.