20th February, 2002

Name :

W32.Yarner.A@mm

Threat Assessment:

Level 3 (moderate)

Description

* Subject of email: Trojaner-Info Newsletter (current date)
* Name of attachment: yawsetup.exe
* Body: The message body is in German

W32.Yarner.A@mm is a mass-mailing worm written in the Delphi language. The worm sends itself to email addresses found in the Microsoft Outlook address book.

The worm uses the system configured or hard coded SMTP servers to send messages with the subject Trojaner-Info Newsletter and a message body in German. The attachment name is yawsetup.exe. In addition the worm may attempt to delete all files on the computer.

When executed, the worm copies itself to: %WinDir%\notepad.exe overwriting the Notepad application. The worm saves the original Notepad application as: %WinDir\notedpad.exe. When executing Notepad, the worm executes itself and then attempts to launch the original Notepad application.

In addition, the worm copies itself to %WinDir%\[random characters].exe. The worm uses MAPI to send itself as yawsetup.exe to email addresses listed in the Microsoft Outlook address book.

Definitions From Symantec

Available.

For more information refer to:

http://securityresponse.symantec.com/avcenter/venc/data/w32.yarner.a@mm.html

Symantec Security Response

Symantec Security Response is one of the industry's largest dedicated team of virus experts. With offices located in the United States, Japan, Australia and the Netherlands, the sun never sets on Symantec Security Response. The centre's mission is to provide swift, global responses to computer virus threats, proactively research and develop technologies that eliminate such threats and educate the public on safe computing practices. As new computer viruses appear, Symantec Security Response develops identification and detection for these viruses and provides either a repair or delete operation, thus keeping users protected against the latest virus threats

http://securityresponse.symantec.com.

Symantec:

Symantec, the world leader in Internet security technology, provides a broad range of content and network security software and appliance solutions to individuals, enterprises and service providers. The company is a leading provider of client, gateway and server security solutions for virus protection, firewall and virtual private network, vulnerability management, intrusion detection, Internet content and e-mail filtering, remote management technologies and security services to enterprises and service providers around the world. Symantec's Norton brand of consumer security products is a leader in worldwide retail sales and industry awards. Headquartered in Cupertino, Calif., Symantec has worldwide operations in 38 countries.

For more information, please visit www.symantec.com.