Skype hit by New version of Yahoo IM worm
Symantec reported that a worm targeting users of instant messaging software Yahoo Messenger on Windows. During the attack, the victim receives a message appear to come from one of his/her contacts and inviting them to click a link to download a photo. The malware, identified by experts is the W32.Yimfoca , analyzes the list of contacts from Yahoo! Messenger and continues to reproduce.
Of course when the victim clicks on this link, the default browser is launched and redirected to an executable file. Once again it trying to pass for a picture but advanced users will notice the extension. exe.
Once it is installed on the machine, the worm is divided and added to the green list of Windows Firewall. Then it disables the manager updates Windows Updates. The malware also infiltrated in the registry and changes the key below in order to be activated each time the computer starts.The malware arrives via instant message through Yahoo or Skype with any one of a number of messages, including “Does my new hair style look good? bad? perfect?” or “My printer is about to be thrown through a window if this pic won’t come out right. You see anything wrong with it?” Bkis wrote in a blog post.
The message includes a link to a Web page that looks like it leads to a JPEG, or image file. When the link is clicked on, the browser displays an interface that looks like the RapidShare Web hosting site and offers up a ZIP file for download. The extracted file is actually an executable file with a .com extension.
The malware, which Bkis has detected as “W32.Skyhoo.Worm,” disappears if the computer does not have Skype or Yahoo Messenger installed. It automatically sends messages with varying content and malicious links to contacts in the victim’s IM list and automatically injects a malicious link in e-mail messages and Word or Excel files that the user is composing, Bkis said.
The worm also connects to an IRC server to receive remote commands, blocks antivirus software, uses a rootkit technique to hide its files and processes and automatically copies itself onto USB drives to spread, according to Bkis.


Recent Comments