moofdev.org

Yahoo Snot

PLEASE READ:
This little piece of code is only presented for educational use. Be aware that it is malware and running it will make your computer do Bad Things^TM. The .exe files will infect your computer and are presented only as proof-of-concept. PLEASE do not run them. If you do get infected, either intentionally or by accident, instructions for removal are presented below.
The source code presented cannot be compiled on its own. Good.

Yahoo Snot is a joke Yahoo Messenger status changer (cough) that installs itself as svchost.exe in your %WINDIR%\system32\drivers\ folder, adds itself to your startup (HKCU...\Run) and then, every 15 seconds, changes your Yahoo! Messenger status message to a predefined one (usually not a very nice one). And remember, it's meant as a JOKE. Don't overdo it.

Here are the official removal instructions.

Romanian only

Troianul s-a plimbat cu titlul de BitComet Accelerator prin internetul românesc, fiind distribuit de niste victime amuzate. A avut şi propriul site pentru o vreme (http://www.bitcomet-accelerator.uv.ro -- disabled) creat de fani pentru... distribuţie facilă :). Probabil îl cunoasteţi ca virusul care schimbă status-ul în "am descoperit că sunt gay pasiv...". Referinţe se găsesc pe forumurile Torrents.ro, Softpedia, chip.ro, RoTorrents şi altele.

Downloads

Builds:

Sorry, we no longer provide precompiled builds of snot. You'll have to make your own! (or not)

Source code:

Yahoo Snot by JTS-UD, version 1.0

Update:

It has come to my attention that some antivirus software can detect my snot. Here's what I have so far: 
AntiVir - TR/IM.Agent.E.1
BitDefender - Backdoor.Brainz.A
DrWeb - Trojan.Aim.31
Ewido - Trojan.Agent.e
Kaspersky - Trojan-IM.Win32.Agent.e

That list will probably grow over time... Well, I'm not going to change it, already had my fun :).

---