|
 |
|
 |
| Tuesday, February 07, 2012
|
| Register Login |
 |
|
|
|
|
Users currently online
|
 |
|
|
|
 |
Membership: |
 |
Latest:
kevin |
 |
New Today:
0 |
 |
New Yesterday:
0 |
 |
Overall:
56 |
 |
People Online: |
 |
Visitors:
4 |
 |
Members:
0 |
 |
Total:
4 |
Online Now:
|
|
|
|
|
|
|
|
|
|
Welcome to the Viruswarning forums. All your original content has been ported to the new forums as well as new content and additional opportunities to interact with the authors of Viruswarn.com. You can always access old content at www.leedrake.com/forum . You may find some formatting was lost in the conversion and the older versions of the posts to be more readable....
But at least it's all here.
Enjoy!
|
|
|
|
|
|
Viruswarn Forums
|
|
|
|
|
| You are not authorized to post a reply.
|
|
| Author |
Messages |
|
EldAztek
Posts:0
 |
| 01/09/2003 8:53 PM |
|
| Happy New Year
I haven't had a chance to compose our yearly New Year's missive, but believe me it's on my to-do list. In the meantime I hope that this New Year finds you happy, healthy and virus free. We've had a recent report that the YAHA virus has become more prevalent. The holiday season always brings new computer users into the fold. There's nothing new about this virus really - it's the same old type of thing we've been seeing for months, but with all the new comps out there - many not protected by virus software, you may want to double check your signatures and make sure all your friends know about viruses. If you have a friend with a new computer, be sure they buy good virus protection, know how to update it, and give them a New Year's gift - sign them up for Viruswarning newsletter.
YAHA - What Is It?
This is your typical executable virus variant. It has it's own SMTP server, a polymorphic message (IE a number of different message bodies and headers), forges the "from" signatures and headers, and spreads through shares to other computers on your network. Like most of the modern viruses it also deactivates Norton, McAfee, CA Inoculan, Black Ice, regedit, and Zonealarm if activated. Messages will come with either a screen save (.SCR extension) or executable (.EXE) extension on the attachment - but we all know not to open those right? RIGHT? :)
If executed it will email itself to:
all the contacts in the Windows Address Book
MSN Messenger
.NET Messenger
Yahoo Pager
Email addresses contained in all the files whose extensions contain the letters HT. (like HTML, SHTML, etc.)
As usual the English and the grammar are atrocious in the faked up messages and headers. This seems to be a sure fire sign that you're getting a virus. :)
What Should You Do?
Run an up to date version of Norton Antivirus or McAfee and set it to scan incoming and outgoing email. Be sure you're running up to date virus signatures. Norton's autoupdate antivirus signatures after December 30th are valid. McAffee's signatures after 12/23 will detect the worm. Both will detect the worm on activation if set for advanced heuristics, though it might be a race between the program and the executable to see who can shut down whom first. Never run .SCR or .EXE files that come as attachments. Activate attachment detection and prevention in Outlook or Outlook express to be sure that you can't even TRY to run the virus.
Additional Information
You can obtain more information about this virus from:
http://vil.mcafee.com/dispVirus.asp?virus_k=99918
http://www.sarc.com/avcenter/venc/data/w32.yaha.k@mm.html
This concludes this VirusWarning notice, dated January 2,2003
Lee Drake
Aztek Computer Solutions, Inc.
39 N. Goodman St.
Rochester, NY 14607
585-242-2060
www.azcomputer.net
To sign up for VirusWarning see the instructions at:
http://www.leedrake.com/virus_notification.htm
|
|
|
|
|
|
| You are not authorized to post a reply. |
|
|
|
ActiveForums 3.6
|
|
|
|
|
|
|
|
|
|
|
|