W32.Yarner.A@mm имэйл ашиглан олон хvнд тараагддаг Delphi программчлалын хэл дээр
бичигдсэн worm юм. Уг worm Microsoft Outlook -ын address book-д байгаа бvх хаягууд
руу єєрийгєє агуулсан хавсралт бvхий имэйл илгээдэг бєгєєд ингэхдээ SMTP серверын
код болон системын тохиргоог ашигладаг байна. Үvнээс гадна тухайн халдварласан
компьютерт байгаа бvх файлуудыг устгадаг.

Захианы vндсэн текст герман хэл дээр
бичигдсэн байдаг ба "Trojaner-Info Newsletter followed by the current date"
гэсэн subject, yawsetup.exе гэсэн нэртэй хавсралт файлтай байдаг.

W32.Yarner.A@mm вирусээр халдварласан компьютерийн тоо бага байгаагаас шалтгаалан
корпораци нь уг вирусын хор хєнєєл учруулах зэргийг 3 байсныг багасган 2 болгосон.

Тєрєл: worm
Илэрсэн он сар єдєр: 2001.2.19
Захианы subject: Trojaner-Info Newsletter [current date
Хавсралтын нэр: yawsetup.exе
Хавсралтын хэмжээ: 427 КВ
Тархалт: Их
Хор хохирол учруулах зэрэг:2
Хор хохирол:
1. Microsoft Outlook -ын address book-д байгаа бvх хаягууд руу єєрийгєє агуулсан
хавсралт бvхий имэйл илгээх байдлаар тархана.
2. notepad.exe файлыг дарж єєрчилнє.

Идэвхжиж эхлээд уг worm дараах vйлдлvvдийг хийнэ.
1. Єєрийгєє %WinDir%\notepad.exe гэсэн нэртэйгээр хуулна. Ингэснээр Notepad-ыг
ажиллаж эхлэхэд уг worm идэвхжин уг программ руу халдахыг оролддог.
2. Мєн єєрийгєє %WinDir%\[random characters].exe гэсэн нэртэйгээр хуулж
HKCU\Software\Microsoft\Windows\CurrentVersion\Runonce регистрт
[тэмдэгтvvд санамсаргvй сонгогдсон байна] = [санамсаргvй тэмдэгтvvд ].exe гэсэн
утгыг нэмж єгнє.
3. MAPI- протоколыг ашиглан Microsoft Outlook-ын address book-д байгаа хаягууд
руу yawsetup.exe гэсэн нэртэй файл илгээж .php, .htm, .shtm, .cgi, .pl єргєтгєлтэй
файлуудыг хайдаг.
Илгээгдэх захианы утга доорх байдалтай байна.
Subject: Trojaner-Info Newsletter [Current Date]
Vндсэн текст:
Hallo!Willkomen zur neuesten Newsletter-Ausgabe derWebseite Trojaner-Info.de.
Hier die Themen im Ueberblick:
01. YAW 2.0 – Unser Dialerwarner in neuer Version
01. YAW 2.0 – Unser Dialerwarner in neuer Version
Viele haben ihn und viele moegen ihn – unseren Dialerwarner YAW. YAW ist nun
in einer brandneuen und stark erweiterten Version verfuegbar. Alle unsere Newsletterleser
bekommen ihn kostenlos zusammen mit diesem Newsletter.Also einfach die angehaengte
Datei starten und YAW 2.0 installieren. BeiFragen steht Ihnen der Programmierer
des bislang einzigartigen Programmes Andreas Haak unter andreas@ants online.de
zur Verf gung. Viel SpaЯ mit YAW!
Das war die heutige Ausgabe mit den aktuellsten Trojaner-Info News. Wir bedanken
uns fuer eure Aufmerksamkeit und wuenschen allen Lesern noch eine angenehme
Woche.Mit freundlichem Gruss Thomas Tietz & Andreas Ebert
Anzahl der Subscriber: 5.966 Durchschnittliche Besuchzahl/Tag: 4.488 Diese Mail
ist kein Spam ! Diesen Newsletter hast du erhalten, da du in unserer Verteilerliste
aufgenommen wurdest. Solltest du unseren Newsletter nicht selber abonniert haben,
sondern eine andere Person ohne dein Wissen, kannst du diesen auf unseren Seiten
wieder abbestellen. Oder sende uns einfach eine entsprechende E-Mail.

4. Мєн %WinDir%\kernei32.daa , %WinDir%\kernei32.das гэсэн нэртэй файлууд vvсгэнэ.
Эдгээр файлууд нь вирус биш боловч тухайн worm-ын ашигладаг сервер болон хаягуудын
тухай мэдээллийг агуулдаг.
5. Эцэст нь Windows -ын vйлдлийн системийн install болон бусад драйвер фолдеруудад
байгаа бvх файлуудыг устгадаг.





Date: September 27th, 2007 | Categories: Вирус | By: | Comments: 3,853

3,853 Responses to W32.Yarner.A@mm

    Spot on with this write-up, I honestly believe this amazing site needs a great deal more attention. I’ll probably be returning to read through more, thanks for the advice!|

    When I originally left a comment I seem to have clicked the -Notify me when new comments are added- checkbox and from now on each time a comment is added I get four emails with the exact same comment. There has to be an easy method you are able to remove me from that service? Kudos!|

    That is a very good tip especially to those fresh to the blogosphere. Short but very precise informationÖ Many thanks for sharing this one. A must read post!

    There is definately a great deal to find out about this subject. I like all of the points you made.

    Wow, this piece of writing is pleasant, my sister is analyzing these things, thus I am going to convey her.|

    Oh my goodness! Incredible article dude! Many thanks, However I am experiencing problems with your RSS. I don’t know why I cannot join it. Is there anyone else having the same RSS issues? Anyone that knows the answer will you kindly respond? Thanks!!

    I constantly spent my half an hour to read this weblog’s articles or reviews all the time along with a mug of coffee.|

    I read this post completely concerning the difference of hottest and previous technologies, it’s awesome article.|

    Very energetic article, I liked that bit. Will there be a part 2?|

    After looking over a handful of the blog posts on your blog, I honestly like your technique of blogging. I book marked it to my bookmark webpage list and will be checking back in the near future. Take a look at my web site too and tell me your opinion.

    Hurrah! After all I got a webpage from where I be capable of really take useful facts concerning my study and knowledge.|

    Greetings, I do think your blog could be having web browser compatibility issues. Whenever I look at your site in Safari, it looks fine however, if opening in IE, it’s got some overlapping issues. I simply wanted to give you a quick heads up! Other than that, fantastic blog!|

    I’m not sure where you’re getting your info, but good topic. I needs to spend some time learning more or understanding more. Thanks for fantastic info I was looking for this information for my mission.|

    I quite like reading through a post that can make men and women think. Also, thanks for allowing for me to comment!

    You ought to take part in a contest for one of the best websites on the web. I’m going to recommend this web site!|

    As a Newbie, I am continuously exploring online for articles that can aid me. Thank you

    An impressive share! I’ve just forwarded this onto a colleague who was doing a little research on this. And he in fact ordered me lunch because I found it for him… lol. So allow me to reword this…. Thank YOU for the meal!! But yeah, thanx for spending time to talk about this topic here on your web page.|

    After I initially left a comment I seem to have clicked on the -Notify me when new comments are added- checkbox and now whenever a comment is added I recieve four emails with the same comment. Is there a means you are able to remove me from that service? Thanks a lot!|

    An outstanding share! I’ve just forwarded this onto a colleague who had been conducting a little homework on this. And he actually ordered me breakfast simply because I stumbled upon it for him… lol. So allow me to reword this…. Thank YOU for the meal!! But yeah, thanks for spending time to discuss this topic here on your site.

    Everyone loves what you guys are usually up too. This sort of clever work and exposure! Keep up the good works guys I’ve incorporated you guys to my own blogroll.|

    This design is incredible! You certainly know how to keep a reader amused. Between your wit and your videos, I was almost moved to start my own blog (well, almost…HaHa!) Fantastic job. I really enjoyed what you had to say, and more than that, how you presented it. Too cool!

    Very nice post. I just stumbled upon your weblog and wanted to say that I’ve truly enjoyed browsing your blog posts. After all I will be subscribing to your rss feed and I hope you write again very soon!|

    When I initially commented I clicked the -Notify me when new feedback are added- checkbox and now every time a comment is added I get four emails with the same comment. Is there any manner you possibly can remove me from that service? Thanks!

    It’s hard to come by well-informed people on this topic, but you sound like you know what you’re talking about! Thanks

    I love reading a post that can make people think. Also, thank you for allowing for me to comment!

    Oh my goodness! Incredible article dude! Many thanks, However I am going through problems with your RSS. I donít understand the reason why I am unable to join it. Is there anyone else having the same RSS problems? Anyone who knows the solution can you kindly respond? Thanks!!

    As a Newbie, I am continuously exploring online for articles that can aid me. Thank you

    Superb site you have here but I was wondering if you knew of any message boards that cover the same topics talked about in this article? I’d really like to be a part of community where I can get suggestions from other experienced people that share the same interest. If you have any suggestions, please let me know. Many thanks!|

    Hello, I log on to your new stuff regularly. Your writing style is witty, keep it up!|

    Simply desire to say your article is as amazing. The clarity in your post is simply spectacular and i could assume you are an expert on this subject. Well with your permission allow me to grab your feed to keep updated with forthcoming post. Thanks a million and please keep up the rewarding work.|

    This web site certainly has all of the information and facts I needed concerning this subject and didn’t know who to ask.

    I couldn’t resist commenting. Exceptionally well written!

    I don’t know whether it’s just me or if perhaps everybody else experiencing issues with your blog.
    It appears as if some of the text on your posts are running off the screen. Can someone else please provide feedback and let
    me know if this is happening to them too? This might be a issue with my browser because I’ve had this
    happen before. Appreciate it http://www.deinformedvoters.org/sildenafil-price

    Wow, superb blog layout! How long have you been blogging for? you made blogging look easy. The overall look of your site is great, let alone the content!|

    Hi! I know this is kind of off topic but I was wondering which blog platform are you using for this site? I’m getting tired of WordPress because I’ve had problems with hackers and I’m looking at options for another platform. I would be great if you could point me in the direction of a good platform.|

    Great blog you have got here.. It’s difficult to find high-quality writing like yours these days. I seriously appreciate individuals like you! Take care!!

    I want to to thank you for this fantastic read!! I absolutely enjoyed every bit of it. I have you bookmarked to check out new stuff you post…|

    Hey There. I found your blog using msn. This is a very neatly written article. I’ll make sure to bookmark it and come back to read extra of your helpful information. Thanks for the post. I’ll definitely comeback.|

    Have you ever thought about including a little bit more than just your articles? I mean, what you say is valuable and all. Nevertheless imagine if you added some great pictures or video clips to give your posts more, “pop”! Your content is excellent but with pics and clips, this blog could certainly be one of the very best in its niche. Good blog!

    This can be an inspiration to many people. Very good job

    Useful information. Lucky me I found your website accidentally, and I’m surprised why this twist of fate didn’t came about in advance! I bookmarked it.|

    This is a really good site post, I’m delighted I came across it. I’ll be back down the track to check out other posts that

    Way cool! Some very valid points! I appreciate you writing this post and also the rest of the site is also very good.

    Great information. Lucky me I found your site by accident (stumbleupon). I’ve bookmarked it for later!

    My coder is trying to convince me to move to .net from PHP. I have always disliked the idea because of the costs. But he’s tryiong none the less. I’ve been using Movable-type on a number of websites for about a year and am nervous about switching to another platform. I have heard very good things about blogengine.net. Is there a way I can transfer all my wordpress content into it? Any kind of help would be really appreciated!

Leave a Reply