A type of worm that spreads on vulnerable Instant Messaging (IM) networks.
Based on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the detected program or file, or ask you for a desired action.
Find the latest advice in our Community Knowledge Base.
See the manual for your F-Secure product on the Help Center.
Submit a file or URL for further analysis.
IM-Worm:W32/Pykse.A is an instant messaging worm that uses the APIR for the Instant Messaging application Skype to send messages with malicious URL links.When IM-Worm:W32/Pykse.A is executed, it will show a picture of a lightly dressed woman as below:
Note: the image has been blurred.
For related details, the F-Secure Weblog has a post on the matter.
When executed, the worm drops the following files:
It adds the following auto start registry entry to enable its automatic execution upon boot up:
It also adds the .DLL component as a BHO (Browser Helper Object) so that once the Internet browser is loaded, the malware is also loaded simultaneously.IM-Worm:W32/Pykse.A creates the following key, to save some of its installation details:
It creates the following mutexes to signify each malicious routine. No duplicate mutex could be created to ensure that only these three mutexes are present in the memory at one particular time:
IM-Worm:W32/Pykse.A spreads via Skype by sending a message with a malware link to all online friends in Skype' contact list using Skype API.The message is randomly chosen from the following list:
It sets the Skype user's status to DND (Do not Disturb) so that the user cannot be actively notified of incoming calls or messages.It visits the following non-malicious links:
Moreover the following site is also visited, which probably acts as a counter for the number of infected machines: