New IM worm - Invites users to a Santa site and installs a rootkit

   Folks need to treat Instant Messages with the same care and suspicions they would email.  Files or URLs found in Instant Messages can be malicious.  This new IM worm installs a rootkit which can be very difficult for AV software to detect and remove.

Links are noted below

Internet Storm Center Warning

Techweb

IM Logic

QUOTE: A new worm posing as a come-on to a Santa Claus site is traveling across all the major instant messaging networks, a security firm warned Tuesday, and when recipients visit the bogus site, they're infected with a file hidden from sight by a rootkit. IMlogic said that the worm, dubbed "M.GiftCom.All," is circulating on the MSN, AOL, ICQ, and Yahoo instant messaging services, is a "Medium" threat, a relatively rare classification for the Waltham, Mass.-based company. Most IM worms and Trojans listed on its Threat Center receive only a "Low" classification. Like virtually all IM worms, M.GiftCom.All includes a URL in messages it spams out to contacts hijacked from previously-infected PCs