The Storm worm that wreaked havoc in January has opened up a new front in its war against users—instant messaging.

The Trojan virus that was responsible for countless spam e-mails sent around the globe has spawned a new variant that is using AOL Instant Messenger, Google Talk and Yahoo Messenger to proliferate. The worm attacks by detecting when someone is chatting and sending out a message with a link to the first stage of malware on a site. If the user clicks the link, the first stage will execute.

"The botnet handlers will periodically inject new commands into this peer-to-peer network, and one of the first things they do is tell the infected machines to download several executables," explained Jose Nazario, software and security engineer for Arbor Networks, based in Lexington, Mass.

"These include updated binaries as well as several other components used for DDoS [distributed denial of service], spam, and additional spreading capabilities, and a rootkit to hide the malware's presence," he continued. "The operators are constantly moving the machines to new network configurations to defeat firewalls and filters."

Read the rest of this eWEEK story: "'Storm' Worm Touches Down on IM"