W32/Yabe.AR is a trojan. The trojan will infect Windows systems.

The trojan will arrive as an attachment along with a spammed email. It may be either downloaded from the Internet or dropped by other malware.

Upon execution, it injects itself in the process SVCHOST.EXE to hide its presence from the user.

It modifies the registry at the following location to ensure its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

It also creates the following registry entries as a part of its installation routine:

HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\Control\Lsa
HKEY_CURRENT_USER\Software\Microsoft\OLE
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole

This Trojan uses the Adobe Acrobat Reader icon to trick users into thinking that it is a legitimate PDF file. Once opened, it displays a fake error message. The generated error may suggest that the PDF file cannot be opened, but in truth, this Trojan is already executed and installed on the system.

The trojan also attempts to download and execute possible malicious files from the following websites.

http://66.235.(BLOCKED).21/~academic/img/horr.dat
http://66.235.(BLOCKED).21/~academic/img/horr.php?new=1
http://(BLOCKED)a-rue.com/mypix/Picture.php?new=1
http://(BLOCKED)a-rue.com/mypix/Picture0.txt
http://testing-one-two.com/editor/ed.php?new=1
http://(BLOCKED)ting-one-two.com/editor/edit.txt
http://www.(BLOCKED)xkabobhouse.com/images/s.dat
http://www.(BLOCKED)xkabobhouse.com/images/stat.php?new=1
http://www.(BLOCKED)gblingventures.com/snake1/uploads/avatars/how.txt
http://www.(BLOCKED)gblingventures.com/snake1/uploads/avatars/stat.php?new=1
http://www.(BLOCKED)keting-know-how.com/bookreview/inc/tss.php?new=1
http://www.(BLOCKED)keting-know-how.com/bookreview/inc/tss.txt
http://www.(BLOCKED)indesigns.net/images/cars/t.dat
http://www.(BLOCKED)indesigns.net/images/cars/t.php?new=1

This trojan first appeared on January 08, 2007.

 Other names of W32/Yabe.AR Trojan:

This trojan is also known as TROJ_YABE.AR .