The worm is downloaded by Trojan.Zbot
When the worm executes, it checks to see if any of the following instant messaging (IM) services are running:
- Google Talk
- Miranda IM
- MSN Messenger
- Paltalk Messenger
- Yahoo Messenger
If any of the above IM programs are running, the worm will send one of the following messages to all users in the contact list of the program:
- check out this picture
- is this you?
- picture of you?
- seen this picture?
- tell me what you think of this photo
- your opinion needed
The above messages may differ depending on the locale of the compromised computer.
The worm will also send the following URL (Trojan.Zbot) to all users in the contact list:
Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":