Type: Win32 worm
Date: 5 June 2002
Sophos has received several reports of this worm from the wild.
W32/Yaha-D is a Win32 worm which spreads via email. The worm has
its own SMTP client software and either uses an SMTP server
found by examining the Windows registry or one from a list
contained within the worm itself. The email sent by the worm is
highly variable. The subject line is made up of a combination of
words and phrases from the following list:
searching for true Love
you care ur friend
Who is ur Best Friend
make ur friend happy
Dont wait for long time
Free Screen saver
Friendship Screen saver
Looking for Friendship
Need a friend?
Find a good friend
I am For u
Life for enjoyment
Nothink to worryy
Ur My Best Friend
Say 'I Like You' To ur friend
Easy Way to revel ur love
Wowwwwwwwwwww check it
Send This to everybody u like
Enjoy Romantic life
Let's Dance and forget pains
war Againest Loneliness
How sweet this Screen saver
One Way to Love
Learn How To Love
Are you looking for Love
love speaks from the heart
Shake it baby
Shake ur friends
One Hackers Love
Origin of Friendship
The world of lovers
The world of Friendship
Check ur friends Circle
how are you
U r the person?
U realy Want this
to ur friends
to ur lovers
The message text is similar to:
Check the attach
Check the attachment too.."
Check the Attachement ..
----- Original Message -----
From: "Friendship" < deleted by FanJ >
To: < sender's address >
Sent: Friday, May 11, 2002 8:38 PM
Subject: The world of Friendship :-)
This e-mail is never sent unsolicited. If you need to
follow the instructions at the bottom of the message.
Enjoy this friendship Screen Saver and Check ur friends
Send this screensaver from <deleted by FanJ> to everyone you
consider a FRIEND, even if it means sending it back to the
who sent it to you. If it comes back to you, then you'll know
have a circle of friends.
* To remove yourself from this mailing list, point your browser
<deleted by FanJ>
* Enter your email address < sender's address > in the field
provided and click
* Reply to this message with the word "REMOVE" in the subject
This message was sent to address <sender's address>
X-PMG-Recipient: <sender's address>
<<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>>
The attachment filename is made up of three parts - a name and
two extensions. The name is chosen from:
The first extension is chosen from:
and the second extension is chosen from:
W32/Yaha-D also creates a copy of itself with a random name in
the Recycle folder. It then adds the name of this copy to the
following registry entry to ensure that the worm is run each
time a program with an EXE extension is run:
The worm will attempt to disable security software by
terminating any of the following processes:
When the worm is first run it will imitate a screen saver by
repeatedly displaying the following messages on the screen in
"U r so cute today #!#!"
"True Love never ends"
"I like U very much!!!"
"U r My Best Friend"
Read the analysis at
Hmm thanks FanJ, as many of us get already lots of spam with such frusty subjects, and either filter or delete manually, good to be extra alert.
Grgrgr the trick to be removed from their database and with that infect yourself! So it's not wise to have autoresponders send "bounces" maybe?
|« Previous Thread | Next Thread »|
|Thread Tools||Search this Thread|