Worm spreading via Yahoo Messenger
A worm is spreading via Yahoo Instant Messenger Thursday that tricks people into downloading what they think is a photo from a friend but is instead malware that installs a backdoor on Windows systems and spreads to a victim’s IM contacts. The worm arrives via a message from a contact with the word “photo” or “photos” and a smiley face icon, along with a link to a Web site resembling a Facebook page, MySpace page, or some other page where photos might reside. If the user clicks on the link on a Macintosh system, an executable file will be downloaded, but no further action will occur. On a Windows system, the executable will download and if the user runs the file, the computer will become infected and the malicious message will be distributed to all of the IM contacts. “Once run, the worm copies itself to %WinDir%\infocard.exe, then it adds itself to the Windows Firewall List,” modifies registry keys, and stops the Windows Updates service, according to Symantec.
