“Code Red was able infect every vulnerable machine on the Internet in 14 hours. Slammer was able to do it in 20 minutes,” says Eric Chien, chief of research at Symantec Security Response. “An instant-messaging threat could spread to a half a million machines in 30 or 35 seconds.” [eweek]
I’m not sure about the IM part of this, but Windows XP Service Pack 2 (SP2) is an important part of preventing the other kinds of attacks.
That’d be a fun proof of concept virus. Everyone in the world on your IM protocol gets a nice “Hello World” popup. Give it a new meaning. Of course third party clients would be invulnerable.