My Bitdefender
  • 0 Shopping Cart


Facebook Twitter Google Plus


~650k, ~2.7MB
(Generic.ImROBOT, Trojan-Im.Win32.Agent.ah, W32/Agent.AK!tr)


The presence of the following files:

The malware also installs the following clean files:

The virus will also modify the following registry key:
  HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
by appending the following strings to it:

The presence of the following subkeys:
Which contains the values:

Removal instructions:

Please let BitDefender disinfect your files.

Analyzed By

Livadariu Mihai Andrei, virus researcher

Technical Description:

The malware spreads through links sent in instant messages on Yahoo!Messenger by other infected users. It tries to convince the target user that the message is legitimate by adding friendly phrases to trick the user into clicking the provided link. The used messages are:

  sa intrii sa imi zici ce parere ai ca sigur recuonsti personaju ;)
  o cunosti?

  chiar vroiam sa te apelez, ai virusi si imi trimiti tot felu de mailuri
  ia programu asta sa il scoti ca l-am avut si eu sau daca nu intra pe http://www.[link removed].ro
  Afla cine te are pus la invizibil sau la ignore cu un singur click chiar si persoanele care sunt offline http://[link     removed]
  ce faci?
  Super tare!!!!!!!! http://[link removed]

Depending on the version of the malware, if the target user replies, the virus will check for the presence of the following keywords in the reply and sends an automatic answer according to what is found:

virusintra ca nu e nici un virus
estiuita-te si vrb dupa
mergetrebuie sa instalezi programu ca sa mearga
fricanu are de ce sa-ti fie frica

Once the user clicks the link he is usually directed to a web site or blog containing an embedded movie which requests the user to download a codec that is actually the malware. When the user executes the downloaded file, a progress bar briefly appears and the following files are installed without user intervention:


It also places itself in the startup list by appending the following string to the registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell


After the next system startup, the yahooui.exe process creates the following registry key:


It waits for the user to sign in to Yahoo!Messenger and saves the username and password inside the values USER and PASS in the HKLM\SOFTWARE\Yahoo\lidl key. The virus will then try to spread by sending spam messages to the contacts in the user's contact list.

The malware also downloads the following files:


seocfg.exe and upd1234.exe are malware files, detected as Trojan.Spy.Banker.ACFQ, which tries to trick the user into accessing phishing sites related to banking. The vbn.sdf file contains the links which are sent in the spam messages.