W32/Yaha.J Worm

 Information about the W32/Yaha.J worm:

W32/Yaha.J is an email worm. This worm is a variant of W32/Yaha  worm. This worm infects Windows systems. It spreads using the email addresses present in the Microsoft Windows address book, NET and MSN Messenger's cached folders and Yahoo messenger's profile folders.

The worm arrives with a random subject. The subject is a combination of words randomly chosen by the worm.

The content of the mail will be:

<<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>>
This e-mail is never sent unsolicited. If you need to unsubscribe, follow the instructions at the bottom of the message.
***********************************************************

Enjoy this friendship Screen Saver and Check ur friends circle...

Send this screensaver from www.truefriends.net to everyone you consider a FRIEND, even if it means sending it back to the person who sent it to you. If it comes back to you, then you'll know you have a circle of friends.

* To remove yourself from this mailing list, point your browser to: http://truefriends.net/remove?freescreen saver * Enter your email address in the field provided and click "Unsubscribe".

OR...

* Reply to this message with the word "REMOVE" in the subject line.

<<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>>

The names of the infected attachments of the worm are randomly generated from the words contained in a list of its own.

The first extension of the infetced attachment can be any one of these .pdf, .doc, .ppt, .jpg, .gif and the second extension is .scr .

Upon execution, the worm displays an error message.

Application initialisation error

The worm copies itself to the Windows/System folder as NAV32.EXE, WINREG.EXE and MSNMSG32.EXE . It modifies the registry at the following locations to load itself during the next startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
HKEY_CLASSES_ROOT\exefile\shell\open\command

A text file is created in the Windows folder with a filename zEsT.txt and the following content.

<<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>>

ir^0^x~X pR3$@Nt$ @Y3rH$.@',0Ah

tHi$ i$ jU$t tH3 b3gInNiNg.. w3 ar3 tH3 gR3@t 1nD1@N$..

w3 k1cK pAk1 a$$..

<<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>>

The worm has a payload, which deletes files of some security software.

This worm first appeared on 13th December 2002.

 Other names of W32/Yaha.J worm:

This worm is also known as I-Worm.Lentin.H, W32/Lentin.G@mm, W32/Yaha.j