[Esd-l] W32/Yarner@MM

[Robby]

Looks like yawsetup.exe needs to be added to the poisoned files.

> -->
> 
>      DRS Virus Alerts
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
>       Virus Name
>       W32/Yarner at MM
> 
> 
> 
> 
> 
> 
> 
>       Date Released
>       18-02-2002
> 
> 
> 
> 
> 
> 
> 
>       Risk
>       Medium
> 
> 
> 
> 
> 
> 
> 
>       Definition detection
>       4187 DAT and 4.0.70 Engine, ExtraDAT available at www.drs.co.za
> 
> 
> 
> 
> 
> 
> 
>       Cleaner available
>       No
> 
> 
> 
> 
> 
> 
> 
>       Brief Description
>       This is a new worm seen by AVERT researchers in Germany and the UK
> today, 19 Feb 2002.
> 
>       This worm has its own SMTP e-mailing engine which gets e-mail
> addresses from .pl, .php, .htm, .shtm, .cgi, and the Outlook address book,
> and uses kernei32.daa to store them. The worm gets e-mail servers from
> \Software\Microsoft\Internet Account Manager\Accounts\SMTP Server and uses
> kernei32.das to store them. The worm copies itself to the Windows folder
> with a randomly selected name, and adds the registry key
> Software\Microsoft\Windows\CurrentVersion\Runonce to run it. It also
> replaces notepad.exe and copies the original notepad.exe to notedpad.exe.
> The worm's payload is to delete all not-locked files from drive c:
> 
>       The virus arrives as an e-mail with:
> 
>       From line faked to read: webmaster at trojaner-info.de
>       Subject: Trojaner-Info Newsletter 18.02.02 (date is updated according
> to infected machine)
>       Attachment: yawsetup.exe
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
>       For More Information follow this link
>      McAfee
> 
> 
> 
> 
>      Symantec
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> ----------------------------------------------------------------------------
> ----
> 
> This message has been scanned for content by MailMarshal from Marshal
> Software. Please feel free to contact our sales staff at +27 11 712 4200 to
> arrange a demonstration or free trial copy.
> 
> 
> ----------------------------------------------------------------------------
> ----
> 
> Try DRS ASaP Free Today!! Latest Anti-Virus Technology In South Africa!!
> 
> http://www.drsasap.co.za
> 
> ----------------------------------------------------------------------------
> ----
> 

-- 

Robert Mc Donald - Support Consultant
Obsidian Systems - Www.Obsidian.Co.Za

Contact: 011-792-6500