Another Virus

ESALADUANE · #1 01-01-2003, 11:02 AM

W32Yaha is spreading. First detected December 21 in a message out of Kuwait, its most active in Egypt, Saudi Arabia and UK. The attachment is UPX compressed and is 34,304 bytes.

It seems to only affect Windows. Hasn't affected Mac, OS/2, UNIX or Linux.

All of the AV sites have a page on it w/remedys.

Watch your e-mail attachments!!!!!

beeboy · #2 01-01-2003, 11:38 AM

Its rampant in my area of Canada as well and as of yesterday Norton had not added it to its catalog. I did an online scan with trend/micro.

ESALADUANE · #3 01-01-2003, 11:43 AM

Norton has a page on it.

http://www.sarc.com/avcenter/venc/da...yaha.k@mm.html

I've also been looking at another site relevent to this:

http://www.sarc.com/avcenter/venc/da...yaha.k@mm.html

ESALADUANE · #4 01-01-2003, 11:44 AM

oops ... I gave you the same link twice. Here is the other link:

http://www.onlinepcfix.com/virushelp/antivirus.htm

beeboy · #5 01-01-2003, 12:19 PM

Thanks duane. I was able to manually install the updates. Is it me or is Norton a little slow. I had nimda and had to find it with another online scan. What good is a virus scanner if they dont act fast? I'm thinkin bout changin to something else. Anyone have any suggestions? I hear a lot a bout AVG and another free one Avast?

ESALADUANE · #6 01-01-2003, 01:05 PM

I think your right. Norton didn't take the virus seriously until December 30 when they upgraded it from class 2 to class 3.

The AV program that I've heard the best things about is Sophos (I'm not sure, but I think its a UK company). I just noticed that Sophos has had W32Yaha in its virus definition library since June!?!?

It's possible that Sophos only licenses to companies, but I'm going to check.

The Tool · #7 01-01-2003, 02:20 PM

McAfee AVERT Stinger can remove it

(yep it is free!)

DA Master · #8 01-02-2003, 02:16 AM

Thanks for the warning. I'll update Norton.

ESALADUANE · #9 01-02-2003, 09:29 PM

PC World has an update on Yaha:

http://www.pcworld.com/news/article/...010203X,00.asp

Tobin · #10 01-03-2003, 06:46 AM

Norton has always been a wee bit slow when it comes to new virus's. It's historical.

McAfee tends to jump right on the new threats, but folks seem to think it's a little more unstable because of that.

I guess it's a personal choice.

Here's another virus that's on the move.

KILLBOOT Trojan -- Word based MBR attack

Systems Affected: Windows 95, Windows 98, Windows ME, Windows NT, Windows 2000, Windows XP

Any WORD document that contains this macro based trojan horse will overwrite the Master Boot Record (MBR area) completely, if the payload is manifested. This means all data is lost, unless advanced repairs could salvage it.

http://www.trendmicro.com/vinfo/viru...ROJ_KILLBOOT.B

beeboy · #11 01-03-2003, 09:30 AM

Thanks Tobin. I guess one has to visit Norton's site daily if one wants up-to-date protection. Thats annoying.

ESALADUANE · #12 01-03-2003, 09:45 AM

Norton has a page on it, but doesn't say much about it except to keep your virus definitions updated. Norton calls it Killboot.45b.