New worms that use Microsoft's instant-messaging software to spread are tunneling their way across the Web.

Antivirus companies on Tuesday flagged a variation of an existing threat and a new worm, both targeting MSN Messenger. Researchers at both Aladdin Knowledge Systems and F-Secure discovered the appearance of Win32.Kelvir.a, a new twist on the previously identified Kelvir threat. Each company also identified a new worm in the wild; Aladdin is calling it Win32.Serflog.a., while F-Secure is calling the same threat Sumom. Aladdin is rating both Win32.Kelvir.a and Win32.Serflog.a as medium-to-high risks. The appearance of the new worms underscores the growing popularity of malicious software that relies on instant messaging, or IM, to spread, and it follows a similar attack last month by another program meant to use Messenger to spread itself. In early February, researchers at Trend Micro detailed a variant of the Bropia worm that used Messenger. The Bropia.f worm was packaged with a second, more damaging worm that tried to exploit computers with improperly patched software.