W32/Yaha-E Worm

Sounds like this guy made a career out of this worm lol. Very feature rich!

I didn't see NOD32, TDS3, Wormguard or KERIO/TINY on the list. I guess the author will have to go back to the drawing board before he can play with the big boys.

 

Just this morning in the news saw one of the dutch ISPs (www.zeelandnet.nl) closes their outgoing emails because of this infection. People can get their account unlocked after kind of "all cleaned" certificate, which people can get via the scanning with the av product they affiliated with, RAV
(i must admit i never heard from them before) ( http://www.ravantivirus.com/ )
Anyway, their online scan told me they could not function as i would not have administrative rights on my pc (! on a win98 system?? with me logged in as user myself?), they could not load activeX components (!! they had downloaded with my permission some tool, and after that message i even put them in my trusted zone and for a few moments even lowered all possible security which i put all back on high after and deleting them from my trusted zone of course!). So i don't know if i ever should give their products any try at all whenever in future with such bad detections on systems!

Speaking about good money, think this ISP is trying to make good money from the Yaha which is hardly a real problem this moment, as the detection is added to all main av/at software.
Strangely enough they didn't give a kick with Klez, which i think is far more a problem.......

 

Hi Jooske,

Here are for example two Dutch sites about it:

http://www.webwereld.nl/nieuws/11576.phtml

http://www.virusalert.nl/?show=nieuws&id=309&PHPSESSID=b1d344c5d4457584e6657319f0043663

 

Thanks Jan, read there the Yaha is more in the Netherlands then anywhere else. Are we dutch all that stupid or just curious to open any email, or don't we update, not patch, asnd are just ignorant? Saw in one of the comments a girl thinking av is getting a thing to have by now (!!!); i would say persons without scanners should not be allowed on internet at all!

Anyway, in the meantime the RAV hurried withy their tech repair and i am trying for the third time now to have my online scan; crashed several times, but unsure if that was again IE 6.0 crashing (it does frequently) so there is doubt, till now each time took many hours per drive, and still not finished so could start all over after each crash;
most nasties in my test zoo are found, some more alarms i like to look at outside that, but even i can't make up what and where with incomplete path and file names, with more the nasties name.... and i make up in one of the email folders is an iframe-exploit found, but if they please are so kind to mention which email in which folder, would be reallhy helpful.
OK, many people might just say "delete" but that could mean here the whole email folder is deleted? And i saw warnings for yaha among others, you should first repair the registry keys and after delete yaha and not in other ways to prevent system damage.......
Such things should be part of a repair tool and a good readme instruction going with that!

Still i don't know about RAV (real anti virus? ) till today never heard of it, did you?
It finds yaha/Lentin in zipped, zipped and attached to emails which are attached to another email and zipped again, unzipped versions etc.

 

Another Dutch site:
http://www.hccnet.nl/404/nieuws.cfm?id=6548

And here is the site of RAV:
http://www.ravantivirus.com/

 

@Home in the netherlands has followed zeeland.net's and XS4all's example in cutting of customers that are infected and keep spreading viruses. They promise to reconnect the victims within a day after they cleaned up their computer without prescribing how that has to be done.
My guess is more will follow.

Regards,

Pieter

 

Then there is one solution: people willing or not, at connecting to internet the free av/at software is auto-updated and full system scan started.
Forcing beta testers to keep their test files on diskettes/cdw

Anyway this is better (the free supplying) then forcing people to get the €36/year software like zeelandnet seems to do, as one might have or prefer other scanners.

Anybody can have been off line for a while and collecting emails, updating av/at and get infected in the meantime, to name an example.

I would prefer to warn the user and give them time (and instructions) to disinfect XX hours before closing their account. And how will the ISP know they are really clean?
Only from the produced traffic? Hmm.

OK, it comes all more or less close to a clean internet obligation, so one could also ask of the ISPs to use strong(er) filters.
Quite a discussion for legality etc.

 

Wow, I have never recieved a virus in email other than those "joke" ones before today... I checked my email and there was 2 emails fromt he same address (nothing I recognize) both with this virus attached. Anyway AVG (I think, had the bug picture, don't think Avast does that) caught them and permanently deleted them nicely enough.

 

I subscribed on many newsgroups --not for infections collection but because the subjects interested me originally--; think those are really nice sources for infection collectors. Most of the groups i send my educative autoresponder after hoaxes and infections are remarkable much cleaner then before and i did not even advice all of them to get my most beloved software (TDS/ WG although it is in my autoresponder text) and i did not intrude their systems to collect the nasties myself unfortunately, although in most cases they came nicely with the postings for my test-zoo.
So one collects even from infections with only 2 or 3 known variants at least 4 or 5 new varieties which i always forward to the TDS lab for their databases.
Today i got another yaha from really unknown source, i searched all my addressbooks, caches, send folder, emails and HTML /DOC/TXT files anywhere on my computer, but this email address was really new to me. It was a fake bounced message (which can be part of yaha) and only one, so i keep watching them.
One possibility could be an infected reply on a bounce email and delete original from my spam protection.

 

Of passing interest, it was Avast that caught the yaha before AVG... I know it doesn't really mean anything but I remembered Avast is the one that puts a big picture of a nasty insect up when it finds something.

 

http://www.webwereld.nl/nav/nb?11616

which is translated in English here at Becky's by Robert Kok:

http://66.119.216.59/ubb/ultimatebb.php?ubb=get_topic;f=14;t=001524

 

The kind folks from @home support Netherlands sent every subscriber a message with the subject "Virus detected!" to inform everyone they will be cut off once Yaha is being sent from your account.

I don't know which moron was responsible for choosing the subject title, but I read on www.troublesathome.nl (not a fan club ) their support department is being swamped by confused callers.

I never use the @home mail server, because it never worked properly and right now it's not available (but that's nothing new). Although I still enjoy my 300 - 400 Kb cable speed

RAV antivirus is one of the few AV natively supporting Novell GroupWise mail server.

 

Thanks to Robert Kok at Becky's who posted this link:

http://www.xs4all.nl/uk/news/overview/klez_yaha.html

 

Picked up this little tidbit in the news:

Nice of them to share their enmity with the whole Internet, eh?