Researchers at security firm Light Cyber revealed this week that one of the malware programs aimed to use the resources of infected PCs to perform the calculations necessary to run a Bitcoin network. Revealed earlier this month by fellow security firm Fox IT, the campaign spread its package by using Yahoo's ad server to deploy malicious ads. The malware took advantage of vulnerabilities in Java to install itself on computers that visited the ads.yahoo.com site. So far, Yahoo hasn't revealed any details on the infected computers or publicly advised affected users on what they should do. But security firm Surfright shed a bit more light on the situation.

Not every ad on the Yahoo advertisement network contained the malicious iframe, but if you have an outdated version of Java Runtime (you can check here) and you used Yahoo Mail the last 6 days, your computer is likely infected.

Communication with the following Internet domains is an indication of a positive infection of the communicating computer:

kmymmeiaoooigke.org bgdjstkwkbhagnp.org ceigqweqwaywiqgu.org smsfuzz.com

Communication with the following Internet domains/IP addresses is an indication of a possible infection:

blistartoncom.org
doesexisted.in
formsgained.in
funnyboobsonline.org
goodsdatums.in
locationmaking.in
mejudge.in
operatedalone.in
original-filmsonline.com
preferringbad.in
savedesiring.in
slaptoniktons.net
slaptonitkons.net
stopsadvise.in
yagerass.org
192.133.137.100
192.133.137.247
192.133.137.56
192.133.137.59
192.133.137.63
193.169.245.74
193.169.245.76

The existence of the following files is an indication of a positive infection:

%windows%\Installer\{4A74FBA7-71A0-BEA1-F538-72E3D519AA4F}\syshost.exe
%localappdata%\cygwin1.dll (See note 1)
%localappdata%\wuauclt.exe (See note 1)
%localappdata%\temp\????????.lnk (8 hex characters)
%localappdata%\temp\????????.exe (8 hex characters)
%localappdata%\temp\vedefuzunwi.exe
%programdata%\bbtmp0\jtkyygiu.exe
c:\temp\zcompute.exe

(1) filename is used by legitimate software but not in the listed path

Yahoo Malware Turned PCs Into Bitcoin Miners