Virus Database

I-Worm.Yarner

Description I-Worm.Yarner

This is a virus-worm that spreads via the Internet attached to infected e-mails. The worm itself is a Windows PE EXE file about 434Kb in length, and it is written in Delphi. The worm was discovered on 18-19 February 2002, and it has a very dangerous payload.
The infected messages have the original sender's e-mail address or fake sender address in the "From" field.
"True" e-mail: Trojaner-Info [%TrueEmail%]
Fake e-mail: Trojaner-Info [webmaster@trojaner-info.de]
Other data in messages appears as follows:
Subject: Trojaner-Info Newsletter %CurrentDate%
Attachment: yawsetup.exe
where %CurrentDate% is the current date, for example, "18.02.02", "19.02.02".
Body:
Hallo !

Willkomen zur neuesten Newsletter-Ausgabe der Webseite Trojaner-Info.de.
Hier die Themen im Ueberblick:

1. YAW 2.0 - Unser Dialerwarner in neuer Version

************************************

1. YAW 2.0 - Unser Dialerwarner in neuer Version
Viele haben ihn und viele moegen ihn - unseren Dialerwarner YAW. YAW ist
nun in einer brandneuen und stark erweiterten Version verfuegbar. Alle unsere
Newsletterleser bekommen ihn kostenlos zusammen mit diesem Newsletter.
Also einfach die angehaengte Datei starten und YAW 2.0 installieren. Bei Fragen
steht Ihnen der Programmierer des bislang einzigartigen Programmes Andreas Haak
unter andreas@ants-online.de zur VerfØgung. Viel Spañ mit YAW!



************************************

Das war die heutige Ausgabe mit den aktuellsten Trojaner-Info News. Wir
bedanken uns fuer eure Aufmerksamkeit und wuenschen allen Lesern noch eine
angenehme Woche.

Mit freundlichem Gruss

Thomas Tietz & Andreas Ebert


************************************
Anzahl der Subscriber: 5.966
Durchschnittliche Besuchzahl/Tag: 4.488
Diese Mail ist kein Spam ! Diesen Newsletter hast du erhalten, da du in unserer
Verteilerliste aufgenommen wurdest. Solltest du unseren Newsletter nicht selber
abonniert haben, sondern eine andere Person ohne dein Wissen, kannst du
diesen auf unseren Seiten wieder abbestellen. Oder sende uns einfach eine
entsprechende E-Mail.
************************************

The worm activates from an infected e-mail only when a user clicks on the attached file. The worm then installs itself to the system, runs a spreading routine and payload.
Installing
While installing, the worm copies itself to the Windows directory with up to 100 symbols and a random .EXE name and registers this file in the system registry auto-run key:
HKCUSoftwareMicrosoftWindowsCurrentVersionRunonce %RandomText% = %WormName%
where %WormName% is the worm copy name, and %RandomText% is another up to 100 symbols of a random string, for example:
ddfUdEDshaSEYadkWBUdFrnKlFWReyHQpTWCqMkkTRhHoIqHMZugxnPTXF.exe
The worm then renames the NOTEPAD.EXE file in the Windows directory with NOTEDPAD.EXE and replaces the original NOTEPAD.EXE with its copy. Thus, the worm creates its additional copy, and will start again when a text file is being opened with Notepad.
The worm also creates two additional files in the Windows directory with the following names:
kerneI32.daa - the worm writes victim e-mails to there
kerneI32.das - the worm writes known SMTP servers to this file
Spreading
To send infected messages, the worm uses a direct connection to the default SMTP server.
The worm obtains victim e-mail addresses in two different ways: First, it gains access to the MS Outlook address book and obtains all e-mail addresses from there. Next, the worm scans all .PHP, .HTM, .SHTM, .CGI, .PL files in all subdirectories in the Windows directory and obtains all e-mails from there.
Payload
After successfully sending an infected e-mail, the worm, in one case in ten, deletes all files on a drive where Windows is installed.

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Hitman

Description Macro.Word.Hitman

This virus contains only one macro AutoOpen. It infects the system and documents on opening. While infecting a document or system the virus displays the MessageBox containing the string "OK!", in case of an error - "ERROR!". The virus contains the comments:
The SMALLEST Macro-virus in history ;)
(c) Master of infection
Queen Hitman Virus inc.

Macro.Word.Horn

Description Macro.Word.Horn

This virus contains two macros: AutoOpen, LittleHorn. It writes itself to the global macros area on opening an infected document (AutoOpen). The virus infects documents on pressing the "e" key - to do that it intercepts keyboard events. The virus does not manifest itself in any way.

Home