A worm is spreading via Yahoo Instant Messenger that tricks people into downloading what they think is a photo from a friend but instead accesses a victim's IM contacts.

If you receive a message from someone you know, with the word "photo" or "photos" and a smiley face icon, along with a link to a Web site resembling a Facebook page, MySpace page, or some other page, you may become one of the latest victims of a “worm,” a malicious computer program that can intercept passwords and other sensitive personal information and send it out over the internet.

If the program is downloaded and opened in Windows system, the computer will become infected and the malicious message will then be re-distributed to all of the user's IM contacts.

Yahoo has recommended that any Yahoo Messenger user who receives a suspicious instant message with a link first IM their friend to ensure the message is legitimate before moving forward. Users should not download executable (.exe) files that are sent through Yahoo Messenger." The company also warned that Internet users should always make sure that their antivirus program is up to date.