Norman Warns Of A New Variant Of Fast Spreading Email Worm

The Data Security Company Norman warns against a new variant of the mass mailer worm, W32/Yaha. W32/Yaha.K comes in what appears to be an ordinary e-mail, and spreads through normal e-mail channels.

The worm uses a large variety of different subject lines, body texts and attachment names, full details of which can be found at www.norman.com.

The worm will copy itself to certain directories in the Windows system, and then make changes to the Registry so that the worm is run before any .exe files are started. When the worm is run during boot, it will look through all running processes, and kill any process it finds that has something to do with antivirus and personal firewall software based on a list hard-coded within the worm itself.

Norman Virus Control with definitions files from December 31st or later detects all known variants of the Yaha worm. Users are encouraged to update their Norman Virus Control protection to the most recent version.