Though Microsoft has filtered the .pif extension, but it is case sensitive, so the worm writers got smart and toyed with this flaw, using .PIF or .Pif or other variation instead, from Kaspersky:

So the criminals used capital letters, ".PIF" and the network filters let the message flow right through. Other variations like .Pif, .pIf, and so on also work.

If your IM friend is already infected, there is very little that you can do to stop the link from being sent to you, but there are a few precaution steps that i would suggest to prevent the worm from getting into your system. Use IM in a Virtual Environment This is at the moment, my best suggestion. It may require a little extra effort for you to activate the IM in a virtual environment, but i really believe it is better to be safe than sorry. Using IM within a virtual environment decreases your percentage of getting worms like this one into your system ,down to nothing. Any worms that tries to infect your PC will be stuck in the virtual folder. If you would like to learn more about Virtualization, read this : Read Virtualization Article. Ask Ask your friend whether the link is legitimate, just make sure it was a human that sent you the link, not a bot. Sounds a bit silly for some people to do this, but there is not harm from asking, there is a lot of harm that follows a worm though, if it infects your PC :-) Skip the .pif file and it's variations Well, this is just common sense, but i still wanna point it out. Microsoft must have good reasons for filtering out this extension, it is best if you follow them. Just in case one of your friend is trying to prank you because you didn't invite him/her to share pizzas with you the other night. By following the three suggestions of mine, hopefully none of you will get infected from this notorious worm (i am hoping i won't get infected again this way, once is more that enough :-)) Read the original article from Kaspersky : Read Original Article