W32.Yaha.C@mm

W32.Yaha.C@mm is a mass-mailing worm that sends itself to all email addresses that exist in the Windows Address Book, the MSN Messenger List, the Yahoo Pager list, the ICQ list, and files with extensions that contains the letters HT. It randomly chooses the subject and body of the email message. Depending upon the name of the Recycled folder, the worm either copies itself to that folder or to the %Windows% directory.

NOTE: %Windows% is a variable. The worm locates the \Windows folder (by default this is C:\Windows or C:\Winnt) and copies itself to that location.

The name of the file that the worm creates consists of six randomly generated numbers.

Protection

• Initial Rapid Release version May 13, 2002
• Latest Rapid Release version May 13, 2002
• Initial Daily Certified version May 13, 2002
• Latest Daily Certified version May 13, 2002
• Initial Weekly Certified release date May 15, 2002

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.