This time it hijacks a Windows computer and, after infection, redirects users to porn site Pixpox.com.
Finjan Software Inc. of San Jose, Calif., said the new “Wallon” worm infects computers when e-mail recipients click on a fake website.
The worm spreads in an email message that appears to be a news site from Yahoo Inc. But the site is not associated with the search engine.
It appears to lay dormant in infected computers until a user attempts to play an audio or video file using the Windows Media Player.
But once a user attempts to use the media player, Wallon sends itself to the victim's email address list, with the bogus web link.
In addition to stealing email addresses so it can spread itself, Wallon forwards the addresses it finds on compromised systems to another email address, which could be harvesting them for spammers.
Finjan on Friday elevated the threat to "medium risk." The company said in a press release that it has seen an increase in the number of emails carrying Wallon.
The company said users should install the latest patches from Microsoft Corp. and update antivirus software regularly.