“Users of AOL Instant Messenger were perplexed yesterday when something that appeared to be a worm spread among the people on their buddy lists. But the program is actually a commercial product.

Dubbed ‘Osama Found’ or ‘BuddyLinks’ by some, the program is a game that secures permission from users to send ads to the people on their buddy lists. It is not malicious code, though. McAfee calls it ‘adware.’ IM management vendor FaceTime Communcations Inc. calls it ‘IM spam,’ or ’spim.’ Others have declared it simply ’scumware.’

Repeated requests for an interview with the supplier of the program were met only with directions on how to remove it. (See sidebar.)

There is no explicit security threat associated with Osama Found, but security experts warn that the program’s ability to spread shows that IM is fertile ground for attackers. Users who automatically click on links sent by acquaintances and install unfamiliar programs represent a weak link in the security chain.”