Reuters shuts down messaging system to fight Kelvir worm

IDG News Service - Reuters Group PLC was able to bring its instant messaging system back online early this morning, after an outbreak of the Kelvir worm led the company to shut down the system for most of yesterday.
The London-based news and information provider detected the external worm on its network coming though a customer Internet portal midmorning yesterday and took the system down as a precaution, said Reuters spokesman Johnny Weir. After ensuring that there were proper filters in place, the IM system was made operational again at 7 a.m. local time today, he said.
The Kelvir worm is designed to use Microsoft Corp.'s IM software as a means of disseminating malicious code. The variant that hit Reuters, W32/Kelvir-Re, was not unique to the company's IM system, called Reuters Messaging, Weir said.
No users reported being infected by the attack, and Reuters' other services continued to operate as normal, Weir said.
Reuters has its own IM application for the financial services industry that it developed to be interoperable with Microsoft's MSN Messenger. Reuters' IM system also works with AOL Instant Messenger from America Online Inc. According to Weir, the problem affected only users on the Reuters system.
The Kelvir worm spreads by sending messages through the IM system to all of an infected user's contacts, encouraging the recipients to visit a Web page to download a file. New versions of both the Kelvir and Bropia worms have been actively attacking systems this year, especially within corporations, according to antivirus software company Sophos PLC.
Reuters has increasingly been connecting customers to its IM system, and there are currently more than 60,000 active users, according to Weir.