W32/Yaha.E-mm is No Laughing Matter
So far, 2004 is progressing with no surprises or major security problems. Of course were not even halfway through January, so dont get too comfortable. The destructive W32/Nachi/Welchia worm is supposed to be removing itself with the New Year, but may still be living in machines that have not been restarted since last year. McAfee has reduced their threat rating because of its self-removal capability.
A new worm, W32/Bugbros-mm, is getting some notice. Rated as a medium threat by Trend Micro and Symantec, it has the potential for wide distribution. Known also as BugGear, the mass mailing worm comes disguised as an e-mail message from Support@microsoft.com with an attachment of varying file names. The attachment, when run, pops up an error message box saying “Run-time error 76; file not found”. It also sends a copy of itself out to everyone on your Outlook contact list. Like most worms, it relies on a user opening the attachment. Since it appears to come from Microsoft, users should be aware that Microsoft never sends out e-mail messages with attachments. For more info on how to recognize a genuine Microsoft e-mail message, the company has posted this article.
W32/Yaha.E-mm, also known as Lentin, is a destructive mass mailing worm that has been on and off of the MessageLabs top ten e-mail virus since early December. This medium level threat comes in a dozen variations, which can terminate antivirus and security software, reset your Internet Explorer homepage, and launch DOS attacks against certain sites. Of course, it also mines your hard disk for e-mail addresses to send copies of itself. We look at W32/Yaha in our Top Threat this week to see how you stop and remove it.
Our old Phishing virus, Mimail is back making trouble with new variations. Mimail.N, has been reported by Sophos and Panda antivirus, and McAfee, Symantec and Trend antivirus companies have reported Mimail.P. These new Mimail strains share similar hooks to get the user to open the attachment, the only way to get infected. The message offers a “GREAT NEW YEAR OFFER FROM PAYPAL.COM!”, and when the user opens the attachment, they get a form asking for financial and personal information. Like past Mimail variations, these all run as single processes, which can be terminated easily and deleted. Both Mimail variations are not very widely spread yet, so updating your antivirus programs will keep it at bay.