It seems that no holiday remains untainted by a malicious programmer who chooses to distribute a virus or worm under the guise of well wishes. Unfortunately, Valentines Day is no exception.
The W32.Yaha.K@mm virus is also known as the Valentine's Day virus. W32.Yaha.K@mm is the latest in a long string W32.Yaha virus that have been discovered over the last year. The latest version may include a payload (i.e. attachment) of a screensaver that is named Valentin.scr. Unfortunately, the message it delivers is not warm-fuzzies from a loved one, but pain and suffering from a virus author.
W32.Yaha is a fairly nasty virus. It is capable of disabling several antivirus and firewall products if it can infect the host systems before it is detected. It is delivered primarily as an e-mail with a script attachment. It even includes its own SMTP server so it can send itself to other victims without relying upon the current victim's e-mail configuration. Once a system is infected, W32.Yaha e-mails itself to every contact found in the Windows Address Book, MSN Messenger, .NET Messenger, Yahoo Pager and all files with extensions that contain the letters H and T (such as .htm and .html). The e-mail will contain a subject and body text chosen at random from a list of about 40 "sweetie" or "lover" type messages, along with an inconspicuous looking attachment.
When W32.Yaha infects a system, it copies itself as the following files in the root Windows folder: WinServices.exe,
Requires Free Membership to View
When you register, you’ll also receive targeted alerts from my team of editorial writers and independent industry experts with the latest news, tips, and advice to help you do your job more efficiently and effectively. Our goal is to keep you informed on the hottest topics and biggest challenges faced by IT professionals today working with desktop management and security technologies.
Margie Semilof, Editorial Director
Nav32_loader.exe and Tcpsvs32.exe. It then adds the WinServices.exe filename and pathname to the Run and RunServices keys in the Registry. It also configures the open command to launch itself before any .exe file is executed. Finally, it copies itself into the System folder as one of many names with either a .exe or a .scr extension.
This virus has been ranked in the top five virus threats since it was discovered just before Christmas 2002. It spreads very quickly and can cause moderate to server damage. The damage caused by this virus is mostly indirect. It can cause a denial of service due to the number of e-mails it generates and its attempt to launch a denial-of-service attack directed toward a specific Pakistani Web site. Plus, if this virus is successful at disabling your antivirus software or firewall, you become vulnerable to every threat on the Internet.
Protection against the W32.Yaha virus involves two primary efforts. First, maintain vigilance on keeping your system secure overall. Second, update your antivirus and firewall software products. Part of this process includes visiting your antivirus software vendor's Web site and downloading a W32.Yaha-specific detection and removal tool.
For more information on W32.Yaha.K@mm, please visit your antivirus software vendor's site or one of these excellent sites:
- http://securityresponse.symantec.com/avcenter/
- http://www.antivirus.com/
- http://www.centralcommand.com/
- http://www.mcafee.com/
About the author
James Michael Stewart is a partner and researcher for ITinfopros, a technology-focused writing and training organization.
This was first published in February 2003