Home Malware Programs Malware YXH-youtube_player

YXH-youtube_player

Posted: January 13, 2012

YXH-youtube_player.xpi and YXH-youtube_player.crx are malicious Youtube extensions. Hackers have initiated a malicious web browser extension attack which poses as a Youtube Player. YXH-youtube_player.xpi and YXH-youtube_player.crx affect Mozilla Firefox and Google Chrome and spread via Facebook. This spam campaign becomes a lot worse when infected PC users post links on websites that are using Facebook Comments Box. At least those web-links that lead to fake Youtube websites are non-clickable. The bit.ly link redirects computer users to a website which pretends to be youtube.com. The PC user is then urged via a pop-up screen to click a notification and then install a Youtube HD Player. In fact, a PC user doesn't even need to click a notification, a download of the malicious extension starts automatically. You shouldn't install add-ons from suspicious websites.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



C:\Documents and Settings\<username>\Application Data\Mozilla\Firefox\Profiles\o45jfr56.default\extensions\admin@youtubeplayer.com File name: C:\Documents and Settings\<username>\Application Data\Mozilla\Firefox\Profiles\o45jfr56.default\extensions\admin@youtubeplayer.com
File type: Command, executable file
Mime Type: unknown/com
C:\Documents and Settings\<username>\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jsgfrtofdhsjrelrjmspsjrtdcrslsjsnrt\6.1.8_0 File name: C:\Documents and Settings\<username>\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jsgfrtofdhsjrelrjmspsjrtdcrslsjsnrt\6.1.8_0
Mime Type: unknown/8_0
Loading...