W32/Yaha.L Worm

 Information about the W32/Yaha.L worm:

W32/Yaha.L is an email worm. This worm is a variant of W32/Yaha.K worm. This worm infects Windows systems. It spreads using the email addresses present in the Microsoft Windows address book, .NET Messenger and MSN Messenger ,Yahoo pager and also email addresses present in file names with .ht extension. The charecteristics of
W32/Yaha.L worm is similar to W32/Yaha.K worm.

The worm arrives with a random subject. The subject is a combination of words randomly chosen by the worm.

The content of the mail is a combination of the messages randomly chosen by the worm.

The names of the infected attachments of the worm are randomly generated from the words contained in a list of its own.

Upon execution, the worm copies itself to the Windows/System folder as TCPSVS32.EXE, NAV32_LOADER.EXE and WINSERVICES.EXE. It modifies the registry at the following locations to load itself during the next startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

A text file is created in the Windows Desktop with a filename aYeHS.txt and the following content.

<<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>>

r0xx pReSaNt$ W32.@YerH$.B (all r1ght$ re$erv3d.. ;) ) w3 aRe tHe gRe@t 1nD1aN$.. ------------------------------------------------------
m@iN mIssIoN iS t0 sPreAd tHe nAmE @YerH$ s00 mUch t0 c0me.. iNclUdEd DDoS c0mp0neNtS c@usE oF sHiT p@kI l@meRs

eXp3ct th3 uNeXp3ctEd

dEdic@t3d t0 : mY b3$t fRi3nD

<<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>>

The worm has a payload, which deletes files of some security software.

This worm first appeared on 30th December 2002.

 Other names of W32/Yaha.L worm:

This worm is also known as I-Worm.Lentin.j , W32.Yaha.L@mm , W32/Yaha.l

Download the FREE Evaluation copy of Protector Plus antivirus software