A new worm has been identified that affects AOL Instant Messenger (AIM) applications. The worm targets PCs that are infected with lockx.exe or palsp.exe.


A new worm has been identified that affects AOL Instant Messenger applications.

The worm targets PCs that are infected with lockx.exe or palsp.exe. The worm then utilizes IRC enabled malware and connects to the server.

The worm then spreads through a series of commands. One of the commands is able to control the AIM client on the infected host. The worm sends a message containing links to the AIM buddy list.

When the recipients click on the link, their PCs are infected with variants of the IRC enabled malware. An executable file “creame.exe” is also installed which delivers multiple adware payloads.

“This worm sends one of the following messages to buddies on the AIM contact list of the infected machine:
1. “great picture 🙂 http://www.picteurestrail.net/Mastermon/XXXXXX.JPG”, or
2. “not a right time to take a picture haa 🙂 http://www.picteurestrail.net/Mastermon/XXXXXX.JPG”
3. “not a right time to take a picture haa 🙂 http://www.pictrail.net/Matelord/XXXXXX.JPG”
4. “not a right time to take a picture haa 🙂 http://www.picstrailx.net/Mateslord/XXXXXX.JPG”” [Source]

Users can conduct a free online scan to detect and disable files such as lockx.exe. To conduct the free scan, click here.

Sharing is caring