IMlogic Threat Center Reports W32/Sumom-A IM Worm is Spreading via MSN and Windows Messenger Clients; Offers Immediate Guidelines for Protection

Business Wire, March 7, 2005

IMlogic

WHAT:       Industry leader IMlogic is warning customers that the
            W32/Sumom-A (also known as W32/Serflog-A, WORM_FATSO.A,
            W32/Crog.worm) worm is spreading, leveraging MSN and
            Windows Messenger clients to distribute malicious
            messages. The worm is intended to convince users to
            download a picture using social engineering techniques.
            The worm sends itself to recipients via MSN Instant
            Messenger using one of the filenames it installs itself as
            on the victim machine. The following filenames are used:

            --  Messenger Plus! 3.50.exe

            --  MSN all version polygamy.exe

            --  MSN nudge bomb.exe

            Once executed, this worm will send messages via MSN and
            Windows Messenger to all of an infected user's contacts. A
            list of malicious URLs associated with W32/Sumom-A are
            provided by the IMlogic Threat Center.

            To learn more about the W32/Sumom-A worm visit the IMlogic
            IM and P2P Threat Center at:

            http://www.imlogic.com/im_threat_center/index.asp

            The worm W32/Sumom-A sends malicious messages through
            IM. To protect your organization, ensure that your
            systems have antivirus software installed and
            running with updated virus definitions, with
            appropriate IM security filters and controls in
            place.

            For companies not currently using IMlogic's
            IM Manager(TM) to securely protect and filter IM
            messages, a free downloadable product released
            from IMlogic - IMlogic Detector Pro - can be used
            to immediately block IM traffic and stop the
            potential for spreading this worm. Companies can
            download IM Detector Pro at no cost directly from
            IMlogic's Web site at
            www.imlogic.com/imdetectorpro. A helpful install
            wizard simplifies the process and guides users
            through each step.

WHO:        Experts from the IMlogic Threat Center can speak with
            technology and business reporters about the increased risk
            from IM worms, viruses and other security threats related
            to the growing popularity of IM use within enterprise.

MORE INFO:  Learn more at IMlogic's Threat Center:
            http://www.imlogic.com/im_threat_center/index.asp.