W32.Yaha.E@mm

W32.Yaha.E@mm is a mass-mailing worm that sends itself to all email addresses that exist in the Microsoft Windows Address Book, the MSN Messenger List, the Yahoo Pager list, the ICQ list, and files that have extensions that contain the letters ht. The worm randomly chooses the subject and body of the email message. Depending upon the name of the Recycled folder, the worm either copies itself to that folder or to the %Windows% folder.

The name of the file that the worm creates consists of six randomly generated numbers.

NOTE: Virus definitions dated prior to June 18, 2002 will detect this as W32.Yaha.D@mm

Protection

• Initial Rapid Release version June 18, 2002
• Latest Rapid Release version June 18, 2002
• Initial Daily Certified version June 18, 2002
• Latest Daily Certified version June 18, 2002
• Initial Weekly Certified release date June 19, 2002

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Medium
• Number of Infections: 50 - 999
• Number of Sites: More than 10
• Geographical Distribution: Medium
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Medium

Distribution

• Distribution Level: High