It displays annoying messages in the Internet Explorer browser with advertising purposes, so that users access websites that advertise different pay services. It spreads via instant messaging programs like Yahoo! Messenger and via Skype.

Windows 2003/XP/2000/NT/ME/98/95

Oscarbot.YQ is worm which displays annoying messages when users are browsing through the Internet Explorer, so that users access websites that advertise different pay services. Although users close these messages, they will be displayed after a while.

Oscarbot.YQ spreads via instant messaging programs like Yahoo! Messenger and via Skype.

Oscarbot.YQ is easy to recognize, as it displays the symptoms below:

• It reaches the computer in a file with the name imagFaceBook, passing itself off as an image when it is actually an executable file:
  
  
• When it is run, the Internet Explorer browser is opened and the legitimate website of myspace is displayed in order to distract users.
• If users try to close the browser or open a new website, a message like the following will be displayed:
  
  
• Users are required to make a survey in order to access certain content.
• If users click on the "Aceptar" button, the browser will be closed or another website will be opened.
• If users click the "Cancelar" button, they will be accepting to make the survey and a message like the following will be displayed: