JS.Blackworm.A
LOW
LOW
6 KBytes
(JS.Yamanner@m)
Symptoms
The virus targets and spreads in yahoo/yahoogroups e-mails with the following specifications:
From: (spoofed)
Subject: New Graphic Site
Body: Note: forwarded message attached.
If you receive such e-mails, do not open them, because the virus will auto-send itself to all your yahoo/yahoogroups contacts. Delete it.
Removal instructions:
Please let BitDefender disinfect your files.
Analyzed By
Patrik Vicol, virus researcher
Technical Description:
The virus is coded in Javascript and exploits a vulnerablity of the Yahoo e-mail system.
Once an infected e-mail has been opened, the virus will automatically execute, and will do:
1. Attempt to get all your contacts, and sort out only those that contain @yahoo.com and @yahoogroups.com
2. Attempt to send itself to all the e-mails gathered with the specifications above (see Symptoms)
3. Sends all gathered contacts to www.av3.net[removed]
The virus does not have a payload, and it is only spreading.
SHARE
THIS ON