Worm installs 'Safety Browser'

[nellie2]

Research experts at FaceTime Security Labs™ identified and reported a new threat today affecting Yahoo! Messenger. FaceTime researchers confirmed that a self-propagating worm, named yhoo32.explr, installs 'Safety Browser' and hijacks the Internet Explorer homepage, leading users to a site that puts spyware on their PCs. Because Safety Browser uses the IE icon, users can easily mistake it for Internet Explorer. This is the first recorded incidence of malware installing its own web browser on a PC without the user's permission.

The self-propagating worm spreads the infection to all contacts in Yahoo! Messenger by sending a website link that loads a command file onto the user's PC and installs Safety Browser. This spam over instant messaging (IM) is called spim. IM applications and protocols are an increasingly popular vector to distribute malicious files and executables.

"This is one of oddest and more insidious pieces of malware we have encountered in years," commented Tyler Wells, Senior Director of Research at FaceTime Security Labs. "This is the first instance of a complete web browser hijack without the user's awareness. Similar 'rogue' browsers, such as 'Yapbrowser', have demonstrated the potential for serious damage by directing end-users to potentially illegal or illicit material. 'Rogue' browsers seem to be the hot new thing among hackers."

Source ¦ Facetime

More info and screenshots here

[andsome]

Tried Yahoo Messenger at my sons request when he was touring abroad. It was one of the most invasive programs that I have ever come across. I couldn't wait to get rid of it on his return.

[korgg]

oh yes .. I also experiece that feeling.. Even you install everything he suggests, still he bugs you around will crap. And now even adobe acrobat reader comes with the option to install yahoo toolbar... I dropped it :) .. But I still have to use yahoo messenger.. Well not really.. GAIM is good for now.

Nice worm :D ..