W32.Yarner.A@mm имэйл ашиглан олон хvнд тараагддаг Delphi программчлалын хэл дээр
бичигдсэн worm юм. Уг worm Microsoft Outlook -ын address book-д байгаа бvх хаягууд
руу єєрийгєє агуулсан хавсралт бvхий имэйл илгээдэг бєгєєд ингэхдээ SMTP серверын
код болон системын тохиргоог ашигладаг байна. Үvнээс гадна тухайн халдварласан
компьютерт байгаа бvх файлуудыг устгадаг.

Захианы vндсэн текст герман хэл дээр
бичигдсэн байдаг ба "Trojaner-Info Newsletter followed by the current date"
гэсэн subject, yawsetup.exе гэсэн нэртэй хавсралт файлтай байдаг.

W32.Yarner.A@mm вирусээр халдварласан компьютерийн тоо бага байгаагаас шалтгаалан
корпораци нь уг вирусын хор хєнєєл учруулах зэргийг 3 байсныг багасган 2 болгосон.

Тєрєл: worm
Илэрсэн он сар єдєр: 2001.2.19
Захианы subject: Trojaner-Info Newsletter [current date
Хавсралтын нэр: yawsetup.exе
Хавсралтын хэмжээ: 427 КВ
Тархалт: Их
Хор хохирол учруулах зэрэг:2
Хор хохирол:
1. Microsoft Outlook -ын address book-д байгаа бvх хаягууд руу єєрийгєє агуулсан
хавсралт бvхий имэйл илгээх байдлаар тархана.
2. notepad.exe файлыг дарж єєрчилнє.

Идэвхжиж эхлээд уг worm дараах vйлдлvvдийг хийнэ.
1. Єєрийгєє %WinDir%\notepad.exe гэсэн нэртэйгээр хуулна. Ингэснээр Notepad-ыг
ажиллаж эхлэхэд уг worm идэвхжин уг программ руу халдахыг оролддог.
2. Мєн єєрийгєє %WinDir%\[random characters].exe гэсэн нэртэйгээр хуулж
HKCU\Software\Microsoft\Windows\CurrentVersion\Runonce регистрт
[тэмдэгтvvд санамсаргvй сонгогдсон байна] = [санамсаргvй тэмдэгтvvд ].exe гэсэн
утгыг нэмж єгнє.
3. MAPI- протоколыг ашиглан Microsoft Outlook-ын address book-д байгаа хаягууд
руу yawsetup.exe гэсэн нэртэй файл илгээж .php, .htm, .shtm, .cgi, .pl єргєтгєлтэй
файлуудыг хайдаг.
Илгээгдэх захианы утга доорх байдалтай байна.
Subject: Trojaner-Info Newsletter [Current Date]
Vндсэн текст:
Hallo!Willkomen zur neuesten Newsletter-Ausgabe derWebseite Trojaner-Info.de.
Hier die Themen im Ueberblick:
01. YAW 2.0 – Unser Dialerwarner in neuer Version
01. YAW 2.0 – Unser Dialerwarner in neuer Version
Viele haben ihn und viele moegen ihn – unseren Dialerwarner YAW. YAW ist nun
in einer brandneuen und stark erweiterten Version verfuegbar. Alle unsere Newsletterleser
bekommen ihn kostenlos zusammen mit diesem Newsletter.Also einfach die angehaengte
Datei starten und YAW 2.0 installieren. BeiFragen steht Ihnen der Programmierer
des bislang einzigartigen Programmes Andreas Haak unter andreas@ants online.de
zur Verf gung. Viel SpaЯ mit YAW!
Das war die heutige Ausgabe mit den aktuellsten Trojaner-Info News. Wir bedanken
uns fuer eure Aufmerksamkeit und wuenschen allen Lesern noch eine angenehme
Woche.Mit freundlichem Gruss Thomas Tietz & Andreas Ebert
Anzahl der Subscriber: 5.966 Durchschnittliche Besuchzahl/Tag: 4.488 Diese Mail
ist kein Spam ! Diesen Newsletter hast du erhalten, da du in unserer Verteilerliste
aufgenommen wurdest. Solltest du unseren Newsletter nicht selber abonniert haben,
sondern eine andere Person ohne dein Wissen, kannst du diesen auf unseren Seiten
wieder abbestellen. Oder sende uns einfach eine entsprechende E-Mail.

4. Мєн %WinDir%\kernei32.daa , %WinDir%\kernei32.das гэсэн нэртэй файлууд vvсгэнэ.
Эдгээр файлууд нь вирус биш боловч тухайн worm-ын ашигладаг сервер болон хаягуудын
тухай мэдээллийг агуулдаг.
5. Эцэст нь Windows -ын vйлдлийн системийн install болон бусад драйвер фолдеруудад
байгаа бvх файлуудыг устгадаг.





Date: September 27th, 2007 | Categories: Вирус | By: | Comments: 2,403

2,403 Responses to W32.Yarner.A@mm

    I’ll immediately clutch your rss as I can’t find your email subscription link or newsletter service. Do you’ve any? Kindly allow me recognise in order that I may subscribe. Thanks.|

    Hi, i think that i saw you visited my web site so i came to “return the favor”.I’m attempting to find things to enhance my web site!I suppose its ok to use some of your ideas!!|

    Excellent blog you’ve got here.. It’s hard to find high quality writing like yours nowadays. I honestly appreciate individuals like you! Take care!!|

    Its like you read my mind! You appear to know so much about this, like you wrote the book in it or something. I think that you could do with some pics to drive the message home a bit, but instead of that, this is fantastic blog. A great read. I’ll certainly be back.|

    Ahaa, its pleasant dialogue regarding this article here at this webpage, I have read all that, so at this time me also commenting at this place.|

    Hello there! Quick question that’s completely off topic. Do you know how to make your site mobile friendly? My site looks weird when viewing from my iphone 4. I’m trying to find a theme or plugin that might be able to fix this problem. If you have any recommendations, please share. Many thanks!|

    Excellent web site. Plenty of helpful information here. I am sending it to several buddies ans also sharing in delicious. And obviously, thank you in your effort!

    Every weekend i used to pay a visit this website, as i wish for enjoyment, for the reason that this this site conations in fact fastidious funny material too.|

    Wow, fantastic blog layout! How long have you been blogging for? you make blogging look easy. The overall look of your website is fantastic, let alone the content!

    Iím amazed, I must say. Rarely do I encounter a blog thatís both educative and engaging, and without a doubt, you have hit the nail on the head. The problem is something too few people are speaking intelligently about. I’m very happy I came across this during my search for something regarding this.

    What a data of un-ambiguity and preserveness of valuable know-how regarding unpredicted feelings.|

    An outstanding share! I have just forwarded this onto a friend who was doing a little homework on this. And he in fact bought me breakfast due to the fact that I stumbled upon it for him… lol. So allow me to reword this…. Thanks for the meal!! But yeah, thanx for spending some time to talk about this matter here on your internet site.

    Definitely, what a magnificent blog and educative posts, I surely will bookmark your website.All the Best!

    Hi there! Do you know if they make any plugins to safeguard against hackers? I’m kinda paranoid about losing everything I’ve worked hard on. Any tips?|

    Hey there! Do you use Twitter? I’d like to follow you if that would be okay. I’m undoubtedly enjoying your blog and look forward to new updates.

    excellent points altogether, you just won a logo new reader. What would you recommend about your post that you simply made a few days ago? Any positive?|

    For hottest information you have to go to see world-wide-web and on internet I found this web site as a best website for latest updates.|

    Everyone loves what you guys tend to be up too. This sort of clever work and exposure! Keep up the very good works guys I’ve added you guys to our blogroll.

    Heya i’m for the first time here. I came across this board and I find It really helpful & it helped me out a lot. I am hoping to offer one thing back and help others like you aided me.|

    I think this is one of the most vital information for me. And i am glad reading your article. But want to remark on few general things, The web site style is perfect, the articles is really great : D. Good job, cheers|

    tolterodine united states tolterodine 1 mg uktolterodine price tolterodine without prescription

    I could not resist commenting. Perfectly written!

    Woah! I’m really enjoying the template/theme of this blog. It’s simple, yet effective. A lot of times it’s hard to get that “perfect balance” between usability and appearance. I must say that you’ve done a excellent job with this. Also, the blog loads extremely fast for me on Safari. Exceptional Blog!|

    Hi there, everything is going sound here and ofcourse every one is sharing data, that’s in fact fine, keep up writing.|

    A fascinating discussion is definitely worth comment. I do believe that you need to write more about this subject, it might not be a taboo matter but generally folks don’t speak about such topics. To the next! Kind regards!!

    After I initially commented I appear to have clicked the -Notify me when new comments are added- checkbox and from now on every time a comment is added I receive four emails with the exact same comment. There has to be a way you can remove me from that service? Many thanks!

    I have to point out my love for your kind-heartedness supporting individuals who should have help on this important theme. Your personal commitment to getting the solution all through ended up being really functional and has usually encouraged people much like me to reach their goals. The informative publication indicates so much a person like me and even more to my office workers. With thanks; from all of us.

    Unquestionably believe that which you said. Your favorite reason appeared to be on the web the simplest thing to be aware of. I say to you, I certainly get irked while people think about worries that they plainly do not know about. You managed to hit the nail upon the top and also defined out the whole thing without having side effect , people could take a signal. Will probably be back to get more. Thanks|

    Nice post. I learn something new and challenging on websites I stumbleupon everyday. It’s always helpful to read content from other authors and use something from their sites.

    Hi, I think your blog might be having browser compatibility issues. When I look at your website in Opera, it looks fine but when opening in Internet Explorer, it has some overlapping. I just wanted to give you a quick heads up! Other then that, wonderful blog!|

    Wonderful work! That is the kind of information that should be shared across the internet. Shame on Google for now not positioning this publish upper! Come on over and visit my site . Thanks =)

    Link exchange is nothing else but it is simply placing the other person’s web site link on your page at proper place and other person will also do similar in support of you.|

    Good day! I could have sworn I’ve been to this website before but after browsing through some of the post I realized it’s new to me. Anyhow, I’m definitely delighted I found it and I’ll be book-marking and checking back frequently!|

    I love your blog.. very nice colors & theme. Did you design this website yourself or did you hire someone to do it for you? Plz respond as I’m looking to design my own blog and would like to find out where u got this from. many thanks

    Along with every little thing that seems to be developing inside this particular subject material, all your perspectives tend to be fairly stimulating. Nevertheless, I beg your pardon, but I can not subscribe to your entire suggestion, all be it radical none the less. It seems to me that your remarks are not completely justified and in simple fact you are generally yourself not entirely confident of your point. In any event I did take pleasure in reading it.

    Do you have a spam problem on this site; I also am a blogger, and I was wondering your situation; many of us have created some nice practices and we are looking to swap strategies with other folks, why not shoot me an e-mail if interested.

    This design is incredible! You definitely know how to keep a reader entertained. Between your wit and your videos, I was almost moved to start my own blog (well, almost…HaHa!) Great job. I really loved what you had to say, and more than that, how you presented it. Too cool!

    Informative article, exactly what I needed.|

    I have been absent for some time, but now I remember why I used to love this site. Thank you, I’ll try and check back more frequently. How frequently you update your web site?

    Nice blog here! Also your site loads up fast! What host are you using? Can I get your affiliate link to your host? I wish my site loaded up as fast as yours lol

    Amazing! Its really awesome paragraph, I have got much clear idea concerning from this paragraph.|

    I really like your blog.. very nice colors & theme. Did you design this website yourself or did you hire someone to do it for you? Plz respond as I’m looking to design my own blog and would like to find out where u got this from. cheers|

    I am now not positive where you are getting your information, but good topic. I needs to spend a while studying much more or understanding more. Thank you for great info I was in search of this information for my mission.|

Leave a Reply