Worm.Yimfoca

There are many threats facing healthy PCs these days, and you will not be able to protect your system from harmful infections such as Worm.Yimfoca without some type of help from a powerful security tool. This worm spreads through popular instant messaging applications and social networking sites. The proven application Worm.Yimfoca uses includes AOL Instant Messenger, MSN Messenger, Skype and Yahoo! Messenger. It will connect to remote HTTP or IRC servers, which will enable it to receive updated configuration data. It will also change specific security and system settings on the infected PC.

%windir%\nvsvc32.exe

The presence of the following registry modifications:
In subkeys:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
Sets value: "NVIDIA driver monitor"
With data: "%windir%\nvsvc32.exe"

When Worm.Yimfoca enters the system, it drops the following file on the system:

%windir%\nvsvc32.exe

This worm will also attempt to stop Windows Automatic Updates and the Microsoft Antimalware service by running various commands on the system. Using predefined ports, Worm.Yimfoca will attempt to connect to these servers:

142.45.183.2
142.45.183.239
142.45.183.241
142.45.183.244
142.45.183.248
142.45.183.249
142.45.183.252

This worm will ultimately give a faceless, criminal hacker complete control of your PC. Protect your system and destroy Worm.Yimfoca immediately. This is safest achieved by making use of the removal power of a genuine security tool which will not only delete Worm.Yimfoca but also protect from similar future infections and attacks.