New e-mail virus spreading (Yaha.K, Windows only; Symantec Category 2, F-Secure Level 2)

BBC News ^ | December 31, 2002

[Timesink]

Tuesday, 31 December, 2002, 14:45 GMT

New e-mail virus spreading

Computer users are being warned about a new virus which is spreading via e-mail.

The virus, called Yaha.K, is a mass mailing worm affecting computers running Windows which first appeared on 21 December.

Since then it has spread quickly, leading the anti-virus firm F-Secure to give it their second highest danger rating.

People are being advised not to open any e-mails which have attachments ending with .scr, .exe and .com.

'I Love You'

Yaha.K is a new version of the Yaha worm which first appeared in February.

It is relatively harmless, compared to more destructive viruses.

It can compromise a computer's security settings by stopping anti-virus programs and shutting down firewalls.

The new variant looks for e-mail addresses in Windows Address Book and sends itself to all the addresses it finds.

In an attempt to trick people, the virus composes several different types of e-mails, using subject lines such I Love You, Patch for Klez.H and Free Demo Game.

Growing threat

MessageLabs, which scans e-mail messages for viruses, said it first detected the worm in Kuwait.

It has now been spotted in 96 countries, predominantly in the UK and the Netherlands.

Overall the company has blocked 21,295 copies of the worm so far.

E-mail viruses have plagued computer users throughout the year. Figures from MessageLabs show that one in every 212 e-mails containing a virus in 2002.

This reflects a big increase on previous years. In 2001, MessageLabs stopped an average one every 380 e-mails, while in 2000 the figure was as low as one every 790.

[Timesink]

Not particularly threatening, just annoying. Keep your virus definitions up-to-date.

[Timesink]

Symantec Security Response

F-Secure Virus Definition

[steplock]

How to keep a secure computer (As much as possible)

1.  Download and install ZoneAlarm  This is, in my opinion, the best FREE Firewall software for the home/small business computer. The FREE version is excellent but they also have a expanded feature pay version HERE.

2.  Download and Install AdAware.  This is the original, and still the best FREE software for removing "Scumware" and other "Malwarez" from your computer.  These unwanted, and malicious programs are installed on your computer by very shady advertising agencies and other "firms" that want to track your every move on the internet.

3.  Download and install AVG Antivirus.  This is an excellent, FREE antivirus system that will protect you while you are surfing and also scans and certifies ALL incoming and outgoing emails.

3a. Download and install the antivirus updates WEEKLY!  Old information will not save your computer.

4.  Is your computer acting like you have a virus?  Just want to feel a bit safer?  Go to TREND MICRO for a FREE On-Line virus scan / Cleaning.  FREE and is kept totally up-to-date.  I would go to this site BEFORE steps 1,2, and 3. Just for a little more safety.

5.  Download and install Window Washer.  PROTECTS YOUR PRIVACY - wipes away all history of your Internet and PC activities - removes unwanted Internet, e-mail and temporary files (like pictures viewed) - eliminates invasive tracking files, clearing disk space to tune up your hard drive.

Since I've installed the above software on my computer - AND kept them up-to-date - I haven't had any virus infections on my computers!


I have found this one - tested and retested on my system - that works with Internet Explorer and Netscape and AOL and most other browsers! It's not free, but it does have a FREE trial download with all the features so you can test it for yourself.  Oh yeah...I almost forgot!  click here -=>WEBROOT

[Rodney King]

On another note, spam now seems to have the ability to disable the delete button in the tool bar. Has anyone noticed this?

[FourtySeven]

Thanks.

About that Window Washer thing, I've seen that advertised before but, is that good though? Why is it any better than just deleting your the History, Temporary Internet Files and cookies yourself?

[S.O.S121.500]

BOOKbump

[AppyPappy]

no

[Andy from Beaverton]

I have been baffled by a virus for a long time. I will get batches of returned mail with a warning from web servers of trying to send them a worm klez virus. I have scanned my system a thousand times and also have several different virus programs that are up to date. Nothing ever shows up. Do you think another server is using my e-mail address to send out viruses? I will always get this returned mail from e-mail addresses that are not in any of my e-mails or address book. Thanks if anybody can help me.

[ken in texas]

The email is being sent from other machines (infected) that have your name in their address book. The klez virus manipulates the email headers to make it look like you sent it.

Check this out.

[SeeRushToldU_So]

About that Window Washer thing, I've seen that advertised before but is that good though? Why is it any better than just deleting your the History, Temporary Internet Files and cookies yourself?

I have been using Windows Washer for years. It is configurable and fast. I highly recommended buying Window Washer.

[VOA]

bump

[YummiBox]

I've always liked the ones built into the browser that stops pop-ups, deletes history, cache, & cookies, on close like:

MyIE2 (which is an IE overlay, tabbed, free)

http://www.ruihehang.com/myie2/html_en/home.htm

[SeeRushToldU_So]

Thanks I will check that out. It sounds very good, great price too :)

[nicollo]

I've got the same problem, exascerbated by a simple email name on a major server. I'm clean of the Klez, but I get inundated with the "returns" from mails being sent out by the infected, other computer. We've tracked the source, and my provider has blocked anything from them, but I still get at least 20 "returns a day." Nothing much can be done. I delete them all from my email server's website before bringing my mail to my computer.

It's annoying, isn't it?

[Brad’s Gramma]

Bumping for tomorrow!

[eddie willers]

I'm clean of the Klez

I have 34 instances of Klez 'quarantined' by my Norton's and cannot understand their (Norton's) instructions as to how to clear them out.

Is it safe to leave them quarantined, or should I do something about them?

[Iowa Granny]

me,too Bump

[cmsgop]

Don't mean to be a jerk or anything but Im glad to have a MAC when I see this type of thing.....

[eddie willers]

Don't mean to be a jerk or anything but Im glad to have a MAC when I see this type of thing.....

My WebTV doesn't get them either....

[nicollo]

I don't know anything about this but what I've been through. I never had the virus on my system. If Norton has klez quarantined, I'd just delete them.

You ought go to the Semantic page posted above. It has a link to Microsoft patches that might solve your vulnerability.