W32.Yimfoca
W32.Yimfoca is a worm that can reduce infected computer’s security settings by stopping processes belonging to Microsoft Malware Protection Service and Windows Update. W32.Yimfoca will propagate by sending malicious links through Yahoo! Messaging program. Malicious files that originates from this family of computer worms are identified as W32.Yimfoca!gen.
Damage Level: Medium
Systems Affected: Windows 9x, 2000, XP, Windows Vista
Characteristics
W32.Yimfoca also modifies Internet Explorer homepage and reset it to a predefined address every 30 minutes.
To disable Microsoft Malware Protection on target computer, this worm will end the following processes:
- MsMpSvc
- wuauserv
Next, the worm will communicate to a remote server and download configuration file. It may also receive commands from specified location using TCP port 2345.
Distribution
W32.Yimfoca typically spreads through Yahoo Instant Messenger. The worm will gather contact details on the compromised computer and sends messages containing malicious link. If a recipient clicks on the link, it instantly downloads a copy of W32.Yimfoca. The same routine is applied to all of its victims to propagate the worm.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"Firewall Administrating" = "%Windir%\infocard.exe" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NVIDIA driver monitor: "[FOLDER NAME]\nvsvc32.exe" HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\NVIDIA driver monitor: "[FOLDER NAME]\nvsvc32.exe" HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\"[FOLDER NAME]\nvsvc32.exe" = "[FOLDER NAME]\nvsvc32.exe:*:Enabled:NVIDIA driver monitor" HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\"[FOLDER NAME]\nvsvc32.exe" = "[FOLDER NAME]\nvsvc32.exe:*:Enabled:NVIDIA driver monitor"Associated Files and Folders:
%Windir%\infocard.exe [FOLDER NAME]\nvsvc32.exe %Windir%\mds.sys %Windir%\mdt.sys %Windir%\mdl.dl %Windir%\winbrd.jpg %Windir%\winbrd.png %Windir%\winbrfy.jpg
How to Remove W32.Yimfoca
1. Temporarily Disable System Restore (Windows Me/XP). [how to]
2. Open your antivirus application and update the virus definition file. This method ensures that your antivirus program can detect even newer variants of W32.Yimfoca
3. Start Windows in Safe Mode with Networking.
- From a power-off state, turn on the computer and press F8 on your keyboard repeatedly.
- Your computer will display Windows Advanced Boot Options menu. Please select Safe Mode with Networking.
- The system will now boot Windows and loads only necessary drivers and files.
4. Open your antivirus program and run a full system scan. After the scan, delete all infected items. If unable, better place them in quarantine. Once the scan is complete, please proceed with the next step.
Online Virus Scanner:
Another way to remove W32.Yimfoca without the need to install additional antivirus application is to perform a thorough scan with free online virus scanner that can be found here or on websites of legitimate anti-virus and security provider.
5. Go to Online Virus Scanner list and run a virus scan. This may require plug-ins, add-on or Activex object, please install if you want to proceed with scan.
6. After completing the necessary download, your system is now ready for online virus scanning.
7. Select an option in which you can thoroughly scan the computer to make sure that it will find and delete entirely all infections not detected on previous scan.
8. Remove or delete all detected items.
9. When scanning is finished you may now restart the computer in normal mode.