JS.Blackworm.A

( JS.Yamanner@m )

SYMPTOMS:

The virus targets and spreads in yahoo/yahoogroups e-mails with the following specifications:

From: (spoofed)
Subject: New Graphic Site
Body: Note: forwarded message attached.

If you receive such e-mails, do not open them, because the virus will auto-send itself to all your yahoo/yahoogroups contacts. Delete it.
 

TECHNICAL DESCRIPTION:

The virus is coded in Javascript and exploits a vulnerablity of the Yahoo e-mail system.

Once an infected e-mail has been opened, the virus will automatically execute, and will do:

1. Attempt to get all your contacts, and sort out only those that contain @yahoo.com and @yahoogroups.com

2. Attempt to send itself to all the e-mails gathered with the specifications above (see Symptoms)

3. Sends all gathered contacts to www.av3.net[removed]

The virus does not have a payload, and it is only spreading.
 

Removal instructions:

Please let BitDefender disinfect your files.
 

ANALYZED BY:

Patrik Vicol, virus researcher