Home Malware Programs Worms IM-Worm.Win32.Yahos

IM-Worm.Win32.Yahos

Posted: December 13, 2010

IM-Worm.Win32.Yahos is a malicious computer worm that spreads through Yahoo Messenger running on Windows platforms. IM-Worm.Win32.Yahos sends a malicious message to the user's Yahoo Messenger contacts. IM-Worm.Win32.Yahos will attempt to spread by sending a link that contains a malicious download. IM-Worm.Win32.Yahos also downloads other malware onto the infected system which spreads through removable drives such as USB flash devices. Remove IM-Worm.Win32.Yahos immediately using a reliable malware remover.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %CommonAppData%\Hitman Pro\Banner.bin
    2 %CommonDesktopDir%\Hitman Pro 3.5.lnk
    3 %CommonPrograms%\Hitman Pro 3.5\Hitman Pro 3.5.lnk
    4 %CommonPrograms%\Hitman Pro 3.5\Remove Hitman Pro 3.5.lnk
    5 %ProgramFiles%\Hitman Pro 3.5\HITMAN~1.EXE
    6 %Temp%\IXP000.TMP\HITMAN~1.EXE

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}[HKEY_LOCAL_MACHINE\SOFTWARE\Hitman Pro]HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}HitmanPro35]

Related Posts

Loading...