Folks need to treat Instant Messages with the same care and suspicions they would email.  Files or URLs found in Instant Messages can be malicious.  This new IM worm installs a rootkit which can be very difficult for AV software to detect and remove.

Links are noted below

Internet Storm Center Warning

Techweb

IM Logic

QUOTE: A new worm posing as a come-on to a Santa Claus site is traveling across all the major instant messaging networks, a security firm warned Tuesday, and when recipients visit the bogus site, they're infected with a file hidden from sight by a rootkit. IMlogic said that the worm, dubbed "M.GiftCom.All," is circulating on the MSN, AOL, ICQ, and Yahoo instant messaging services, is a "Medium" threat, a relatively rare classification for the Waltham, Mass.-based company. Most IM worms and Trojans listed on its Threat Center receive only a "Low" classification. Like virtually all IM worms, M.GiftCom.All includes a URL in messages it spams out to contacts hijacked from previously-infected PCs