Malware found in MSN Messenger banner ads

Microsoft has admitted its Windows Live Messenger client displayed banner ads for several days punting an application blacklisted as a security risk, The Register reports.

Microsoft has pulled the ads for Errorsafe, a purported security product labeled by legitimate firms as “scareware” designed to frighten users into buying a product that actually impairs Internet safety. Microsoft has promised to review its advertisement approval process in order to prevent the problem cropping up again.

For a period earlier this week, Errorsafe, which is listed as a security risk alongside related packages such as Winfixer, appeared as a banner ad inside Windows Live Messenger.

Worse still, pop-up ads punting the product were served to users running Windows Live Messenger. These pop-up ads appeared without user interaction. Clicking on the OK or Cancel buttons in this pop-up window would have resulted in an attempt to download a malicious ActiveX control without a user’s permission.

Shortly after Microsoft made the admission, other outlets reported that MSN Groups displayed ads for a separate piece of software widely regarded as rogue.