Home / malware

PDF

W32.Picazburt

First posted on 21 February 2014.
Source: Symantec

Aliases :

There are no other names known for W32.Picazburt.

Explanation :

The worm is downloaded by Trojan.Zbot.

When the worm executes, it checks to see if any of the following instant messaging (IM) services are running:
ChatskinGoogle TalkICQ Miranda IMMSN MessengerPaltalk MessengerQQSkypeTrillianXfireYahoo Messenger
If any of the above IM programs are running, the worm will send one of the following messages to all users in the contact list of the program:
check out this pictureis this you?picture of you?seen this picture?tell me what you think of this photoyour opinion neededThe above messages may differ depending on the locale of the compromised computer.

The worm will also send the following URL (Trojan.Zbot) to all users in the contact list:
[http://]goo.gl/2vN[REMOVED]

Last update 21 February 2014

 

TOP