Add a virus spread through Yahoo! IM

Afternoon 1-8, a virus named VloveYM has spread to many computers in Vietnam. According to the analysis of the Network Security Center (BKAV), this virus appeared on July 28.

Like previous Gaixinh (Xrobot) and YMHeart viruses, VloveYM mainly spreads among Vietnamese people using Yahoo! Messenger.

When clicking on the link, the user will see a menu asking to download the Vlove file to the computer.

The new virus that appears and is spreading strongly via Yahoo Messenger - we call it "VLove" temporarily (Calling the Vlove.exe file name of the virus link) - is distributed from a website with the address http:// /nguoiiu.com/funny/ .

If the computer has been infected with VloveYM, the virus will change its IE homepage to fun.nguoiiu.com . It is not possible to remove this homepage address, either by changing the homepage address or by using spyware scanning programs. Next to those in the address book of this device will simultaneously receive links on chat windows such as' http . oiiu.com/funny/: D Funny via ne ',' http . oiiu.com / funny / Do you want it, go to it =)) ',' http . oiiu.com / life / Tang ne =)) ',' http . oiiu.com / life / Tang ban tam thiep ne` . 'and will be thought of by your chat. It is the virus-infected person who does not know that he is spreading these dangerous links. If you click on it, the computer will be infected. These links immediately ask users to download a virus file called " Vlove.exe ".

Immediately after having this information, VietNamNet contacted Bui Hai Nam - author of the Xrobots virus before. Nam affirmed that this is not his "masterpiece", but initially stated, it is likely that Vlove virus dispersers have used the source code of Xrobots written by Nam by reverse analysis (reverse) from the file. exe.

" In my opinion, this virus is also written in Autoit - this is the program I use to write Xrobots. Moreover, the source code is from the reverse Xobots.exe virus file is now spread quite a lot on the network. " - Nam confirmed.

However, according to our assessment, if we get the source code from Xrobots, Vlove has obviously been "improved". Evidence is that despite the Xrobots virus update, the latest anti-virus version of BKAV still doesn't kill Vlove. (Test conducted on 14h on August 1, 2006).

The BKIS Network Security Center said that they have now successfully analyzed Vlove and found the culprit to spread the virus. " It was a young man born in 1987 " - Mr. Nguyen Tu Quang - BKIS director said that along with the promise, he will update Vlove at the end of today in BKAV version.

Last night, BKAV updated this virus pattern in Bkav881 antivirus version. Users can go here to download.