Re: Virus? Trojan?

From: James C. Slora Jr. <Jim.Slora(at)phra.com>
Date: Sun Jan 12 2003 - 21:28:15 EST

Nick FitzGerald wrote Sunday, January 12, 2003 6:39 PM

> Yaha.K was discovered before Christmas, and although that machine

Thanks for the correction.

I looked at headers and message text, and I stripped the attachments without analyzing them.

Headers and message body options are AFAICT the same between K and M and match no other other circulating worms, based on Trend Micro and Symantec descriptions. My original determination that the infection was M rather than K was based on David Gillett's assertion that Norton (unspecified product) did not detect a worm in the message at a time when definitions detecting K were already available.

When the new messages arrived, they were apparently more of the same and I reported them as such. For notification purposes I believe that this admittedly imprecise analysis was adequate, despite my incorrect conclusion.

For the sake of absolute correctness I should not have specified the infection as Yaha-M when I had never performed a positive binary analysis of the attachment - I should have just said maybe "apparently one of the newer varieties of the Yaha family of worms, based on message headers and text".

> I agree that the sender may be on this list or a frequenter of the

> > Since the infections are still coming I've notified the administrator of
clear
> > the infection.

Thanks for sharing their response. I have not received anything from zeelandnet.nl administrators beyond the initial automated response. I have also not received any more infected messages from the offender since submitting the notification (which of course doesn't prove anything).

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Mon Jan 13 01:06:25 2003