New worm spreading as photo link through Yahoo Messenger

(vIndianz May 7, 2010): Various internet and data security firms have issued warnings about a new type of worm that is spreading through Yahoo! Messenger.

yahoo-messenger

The worm appears in an instant message (IM) on Yahoo messenger as a link to a photo on a social networking website along with a smiley face. Unsuspecting users are urged to click on the link and download a file which is actually a malicious executable file in disguise. If the link is clicked on a Macintosh system, then the file is downloaded into the system but there is no further action. On a Windows-operated system, the file downloads itself and once the file is run by the user, the worm infects the computer.

The worm gets copied to the %WinDir%\infocard.exe file and gets added in the Windows Firewall list. It blocks the operation of the Windows Update service and also sets a registry value for itself so that it is activated every time the system is booted up.

It also infects the Yahoo Messenger application on the user’s computer and sends out its link to all the contacts in the Yahoo Messenger contact list. Other malicious executable files can also be downloaded by the worm.

Internet security firm Symantec said that its anti-virus programs detect the malicious file as W32.Yimfoca. Security firms BitDefender and Bkis have also obtained information on the worm with BitDefender warning on its blog that the worm may be able to intercept passwords and access sensitive data.

Yahoo has announced on its blog that it is aware of the problem and are attempting to resolve the issue.

Further Reading