Home Malware Programs Worms Yimp.b

Yimp.b

Posted: March 28, 2006

Yimp.b is an Internet worm, which spreads through instant messages sent using the AIM or Yahoo! Messenger application. The victim receives a message containing a link to a malicious file. Once he or she clicks on a link and executes a file, the worm immediately installs itself to the computer and runs a spreading routine. Yimp.b sends bogus instant messages to all the user's contacts. Then it runs a payload. It drops and installs an adware spyware and unsolicited software. Yimp.b automatically runs on every Windows startup.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 1004270.exe
    2 is.exe
    3 kernal64.exe
    4 ysbagree.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{RegistryKeys}HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunwindowskernel64HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunwindowskernel64
Loading...