Yahoo Messenger Worm

[zynder]

Hi guys,

My friend got this worm from YM by clicking a link sent out by one of her friends.

Now I'm fixing her computer. To my surprise, I cannot run an exe except for Firefox.

I cannot install Hijackthis. I cannot run msconfig or any anti virus. The worm closes it automatically.

Any input is greatly appreciated.

[Nightwalker83]

No sure if this will help or not?

[Siddharth Rout]

Yes the name of the worm is W32.Yimfoca. All that I wanted to say about that worm is already in that link by NW.

Few more things that I would like to add... (Which I didn't see in that link... Ignore the below if it is already mentioned)

This worm copies itself to %WinDir%\infocard.exe, then it adds itself to the Windows Firewall List, modifies registry keys, and stops the Windows Updates service...The worst part is that it keeps on dropping software onto infected computers that can be used to turn them into zombies on a botnet!!! Also the most scariest part is that it adds itself to the Windows Firewall List there by creating a back door...

It is usually transmitted via yahoo as zynder suggested...

You might think that it is an image from a face book profile or from My Space.. It looks something like this...

http://blahblah.com/image.php

What makes it worse is that most of the times it comes from an ID which you already know

One should be careful while downloading stuff from IM's. Ensure that your anti virus is updated always and if you do NEED to download something from IM then simply don't directly click it... Right click on it and do a "Save As". Your anti virus will automatically scan it when the download is over but if it doesn't then my recommendation is to scan that file manually by right clicking on it and selecting the option "Scan with <your antivirus>"

Hope this helps...