W32/Yaha.L worm

Download free anti virus software

Anti virus software information

Order anti virus software (US$ 29.95)

Protector Plus
Anti virus software for

Windows
(XP, 2000, 2003, NT, Me, 98, 95)

Exchange

NetWare

W32/Yaha.L Worm

Information about the W32/Yaha.L Worm:

W32/Yaha.L is an email worm. This worm is a variant of W32/Yaha.K worm. This worm infects Windows systems. It spreads using the email addresses present in the Microsoft Windows address book, .NET Messenger and MSN Messenger ,Yahoo pager and also email addresses present in file names with .ht extension. The charecteristics of
W32/Yaha.L worm is similar to W32/Yaha.K worm.

The worm arrives with a random subject. The subject is a combination of words randomly chosen by the worm.

The content of the mail is a combination of the messages randomly chosen by the worm.

The names of the infected attachments of the worm are randomly generated from the words contained in a list of its own.

Upon execution, the worm copies itself to the Windows/System folder as TCPSVS32.EXE, NAV32_LOADER.EXE and WINSERVICES.EXE. It modifies the registry at the following locations to load itself during the next startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

A text file is created in the Windows Desktop with a filename aYeHS.txt and the following content.

<<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>>

r0xx pReSaNt$ W32.@YerH$.B (all r1ght$ re$erv3d.. ;) ) w3 aRe tHe gRe@t 1nD1aN$.. ------------------------------------------------------
m@iN mIssIoN iS t0 sPreAd tHe nAmE @YerH$ s00 mUch t0 c0me.. iNclUdEd DDoS c0mp0neNtS c@usE oF sHiT p@kI l@meRs

eXp3ct th3 uNeXp3ctEd

dEdic@t3d t0 : mY b3$t fRi3nD

<<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>>

The worm has a payload, which deletes files of some security software.

This worm first appeared on 30th December 2002.

Other names of W32/Yaha.L worm:

This worm is also known as I-Worm.Lentin.j , W32.Yaha.L@mm , W32/Yaha.l

Click here to download a 30 day Evaluation Copy of
Protector Plus anti virus for your operating system

About Protector Plus Anti virus Software Packages:

Proland Software is the developer of Protector Plus range of anti virus software packages. Protector Plus anti virus is available for Windows XP, Windows Me/98/95, Windows NT/2000/2003 servers and workstations, MS-Exchange 2000/2003, MS-DOS and NetWare servers.

Protector Plus range of anti virus products offer on-line virus detection and removal. All the packages have the ability to detect and isolate all types of viruses, trojans, worms and other types of malware. Protector Plus can detect and remove W32/Yaha.L reliably.

These products are updated on a continuous basis and the latest upgrades for all the platforms are made available for downloading from this site.

You can download the 30 day evaluation copy of
Protector Plus anti virus software free of cost for these platforms:

Windows | Exchange | NetWare

Download free anti virus software | Anti virus software information | Order anti virus software