Re: Virus? Trojan?

From: Peter Kruse <kruse(at)railroad.dk>
Date: Mon Dec 30 2002 - 18:42:42 EST

Hi David,

That would be Yaha-K. This new variant is spreading heavily in Holland. Earlier today McAfee opgraded the worm to a medium risk:
http://vil.nai.com/vil/content/v_99918.htm

There are many subject lines/Message bodies/Attachment names that W32/Yaha.k may use.

It's very likely spreading because of problems with the invalid MIME formatting of some of the Yaha.k mails. The worm is known to be able to pass through mailsweeper v4.2x.

Kind regards
Peter Kruse
Securityconsultant
http://www.krusesecurity.dk

• Original Message ----- From: "David Gillett" <gillettdavid@fhda.edu> To: "'Incidents List'" <incidents@securityfocus.com> Sent: Monday, December 30, 2002 11:03 PM Subject: Virus? Trojan?

> So far today, I've received two email messages from

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Mon Dec 30 18:53:50 2002