News

K Strain of Yaha Worm Causes Headaches

Two major anti-virus vendors upgraded the threat level on a variant of the Yaha virus as the mass-mailing worm spilled outside of its original range in the Middle East and Europe into the United States.

Symantec boosted the K strain of the Yaha virus from Category 2 to Category 3 on its five-level threat classification system. McAfee upgraded the K strain to a "Medium" threat.

Yaha K, which has also gone by the strain letter M, spreads as a 34-KB attachment on messages with varying subject and attachment names and message body texts. It spreads through e-mail using its own internal SMTP client, which searches the Windows registry for an SMTP server or uses one from a list contained in the worm itself, according to Sophos.

Yaha can take addresses from the Windows Address Book, MSN Messenger, .NET Messenger Services, Yahoo! Pagers and all files with extensions containing the letters HT, according to Symantec.

The worm terminates anti-virus and other security-related processes, while launching a denial-of-service attack against a Pakistani target server that is hard-coded into the worm, McAfee's description of the worm says.

The original version of Yaha appeared in March, according to MessageLabs Ltd.'s Web site. Different packages containing a J variant went out in December, causing confusion among anti-virus vendors and customers about whether systems were protected, MessageLabs experts contend. Meanwhile, the most virulent strain yet, Yaha K, which was different from the three J versions, was first stopped by MessageLabs on Dec. 21 in Kuwait. MessageLabs stoppage activity involving Yaha K peaked on Monday at more than 8,000, and the company has stopped the worm 37,463 times since Dec. 21.

Those volumes are substantially lower than Klez and Bugbear at their peak. For example, in the last 24 hours, according to the MessageLabs site, the A-V vendor stopped Klez 14,715 times compared to 6,560 times for Yaha K.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.

Featured

  • Broadcom Revamps VMware Partner Program Again

    Broadcom recently announced a significant update regarding its VMware Cloud Service Provider (VCSP) program, coinciding with the release of VMware Cloud Foundation (VCF) 9.0, a key component in Broadcom’s private cloud strategy.

  • Closeup of the new Copilot keyboard key

    Microsoft Updates Copilot To Add Context-Sensitive Agents to Teams, SharePoint

    Microsoft has rolled out a new public preview for collaborative "always on" agents in Microsoft 365 Copilot, bringing enhanced, context-aware tools into Teams channels, meetings, SharePoint sites, Planner workstreams and Viva Engage communities.

  • Windows 365 Cloud Apps Now Available for Public Preview

    Microsoft announced this week that Windows 365 Cloud Apps are now available for public preview. This aims to allow IT administrators to stream individual Windows applications from the cloud, removing the need to assign Cloud PCs to every user.

  • Report: Security Initiatives Can't Keep Pace with Cloud, AI Boom

    The increasingly fast adoption of hybrid, multicloud, and AI systems is easily outgrowing existing security measures, according to a recent global survey by the Cloud Security Alliance (CSA) and exposure management firm Tenable.