Update: Another virus hits Yahoo! Messenger.

A virus which is not new to Yahoo!'s network seems to be hitting it again. A Romanian website for security warns users of Yahoo! Messenger about its existence and offers help in fixing it. This virus sends various links, most of them referring to Facebook (so this creates confusion between users). Some of them are pasted here:

• http://ow.ly/2D4zB?=www.facebook.com/photo.php
• is this you on pic?  http://ow.ly/2cWs2?=www.facebook.com/photo.php
• foto :D http://ow.ly/2d3aB?=www.facebook.com/photo.php
• foto :D http://ow.ly/2cTes?=www.facebook.com/photo.php
• foto :D http://ow.ly/2bmMb?=www.facebook.com/photo.php
• foto :D http : //ow.ly/2b7Xp?=www.facebook.com/photo.php
• foto :D http://ow.ly/2aG6r?=www.facebook.com
• foto :D http://ow.ly/2arJj?=www.facebook.com
• foto :D http://ow.ly/2aHoc?=www.facebook.com

The virus asks user to download a file, which is, of course, the virus. Here are some examples of files containing the virus:

• 012457566896789-JPG-www.facebook.com.exe
• PIC348u6234-www.facebook.com.JPG.exe
• n719753102_09.JPG-www.facebook.exe
• n11975310_09.JPG-www.facebook.exe
• n11975310_09.JPG-www.facebosok.exe
• n777719102_09.JPG-www.facebook.exe
• 102_09.JPG-www.facebook.exe 
• 9.JPG-www.facebook

Normally, an antivirus program should detect the malware and remove it, but if it doesn't (or you don't have one), you may download Palevo Removal v2 from here. This program should automatically close the virus and remove it. All you need to do then is to reboot. 

Note: Windows 7 and Vista users must click "This program works correctly" when prompted. 


Thanks to the Romanian website called IT Security which made everything possible. (Google translated webpage here).


Update: The admin from IT Security warned me that the virus is downloading more and more files with strange names (it's quite impossible to keep up with it). He also told me that using Malwarebytes should help much (download here). Make sure to update after installation and then perform a full scan. 

iAntiVirus - free malware protection for your Mac.

As we all know, Mac is a really safe OS but the truth is that no platform is immune to any kind of malware. Even the Mac OS X. However, the risk on infection on Mac is really low, since most of the attacks are directed against Windows. So there isn't a real necessity to use an antivirus software if you're on Mac, but if you have "terrifying" experiences from Windows, you may use one.

iAntiVirus is a free antivirus solution for Mac, offering most of what a regular user needs. As the official site says, this application offers powerful malware protection (viruses, worms and trojans) - detection and removal-, spyware, adware and dialer protection, real-time protection via "IntelliGuard Real-Time Protection", free support by community and free "Smart Updates".

It offers just a basic interface, and uses very little resources as I even don't feel it working in the background. These are what the free version offers. If you need it for business and commercial purposes, 24/7 dedicated and phone support, paid version is also available.

Consult the official site for more details: http://www.iantivirus.com/.

Twitter is under a phishing attack.

In this period an attack is developing on Twitter. It consists into receiving direct messages containing "lol, is that you" or "lol, this is funny, followed by a link. When you enter the link, you will be asked to enter your user and password, and, after this procedure, your account will start sending the same messages. If you got the message, you shouldn't worry, but if your account starts sending these types of messages by its own, change your password immediately.

The messages will take you to a page from allinonecontracting.com, which links after to bzpharma.net. Anything you're doing, do NOT click on these links.

hi5update.exe, a new virus on HI5.

A new virus that attacks HI5 has been seen for the first time a few days ago. Users reported that it requests them to download "hi5update.exe" which will steal their password after installation. It has also been reported that the virus can be found on a few Romanian websites. The main idea is that you should NOT download an executable file which is named "hi5update.exe". I found informations about this virus from Romanian bloggers, who already submitted it to anti-virus companies in order to help them to offer users protection as soon as possible.

If you're already infected, try to do the following:

1)delete from C:\Windows\system32:

• winlog.exe
• boot.exe

2)delete from registry the following keys:

• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run \Font

3) Get Kaspersky Virus Removal Tool 2010 from Softpedia, and run it: http://www.softpedia.com/get/Antivirus/Kaspersky-Virus-Removal-Tool.shtml .

More informations can be found here: http://devirusare.com/2010/01/03/hi5update-exe-devirusare/ (for Romanian users, others can use Google Translate).