Win32/Yahlover

Installation

Win32/Yahlover copies itself to <startup folder> with read-only, hidden and system attributes.

It uses a variable file name, for example we have seen it use Adobe.exe.

Spreads via...

Instant messenger programs

Win32/Yahlover looks for instant messenger programs on your PC. It can spread itself using the following applications:

• AIM
• Windows Live Messenger
• Windows Messenger
• Yahoo! Messenger

If these applications are found the malware uses them to send a malicious URL pointing to a malware copy hosted at a remote server location. It sends messages created using random combinations of the following text as well as the malicious URL:

• :X
• :D
• :)
• :))
• alo
• aloha
• hey
• heloooo
• hey there :D
• hi
• is it cool :D <malicious URL> 
• I told you I got an iPhone4 for free :)) <malicious URL>   
• <malicious URL>  b-)                                     
• <malicious URL> :D                                       
• <malicious URL> see my new clip on Youtube =))        
•  my new iPad is coming ;;) <malicious URL>    

We have seen <malicious URL> point to youtube.com%2Echeckconfig%2<removed>/?video=flash&vid=thr2503.

Payload

Modifies your browser home page

We have seen this threat making comicosy.com the default browser home page on infected machines.

The malware changes your web browser home page by modifying the following registry entry:

In subkey: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Sets value: "Start Page"
With data: <malicious URL>

In subkey: HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel
Sets value: "Homepage"
With data: "1"

Clicks on ads

Win32/Yahlover tries to click on advertisements without your permission. It clicks on advertising in Internet Explorer windows that have the title: "Active marketing website for ads - Microsoft Internet Explorer".

Downloads data

Some variants can download other files onto your PC, including other malware.

We have seen it connect to the following URLs to download files:

• 174.121.2.58/<removed>/update/cw2010.exe
• 174.121.2.58/<removed>/update/CWcount.php

Analysis by Teoderick Contreras