Complain about a product or service

Love Bug Hits The Internet

Those seeking love online may wind up with a virus instead

By D. O. Volente
ConsumerAffairs.com

February 11, 2008 

Valentine's Day computer viruses, especially “Vbs_Valentin.A,” spread chiefly through emails or online chat systems; Xinhua quoted China National Computer Virus Emergency Response Center experts, as saying.

According to experts, other viruses like “Worm-blebla.B” and “VBS-ILoveyou” are also likely to attack computers if users open emails or attachments disguised with Valentine blessings for February 14.

The W32.Yaha.K@mm virus is also known as the Valentine's Day virus. W32.Yaha.K@mm is the latest in a long string W32.Yaha virus that have been discovered over the last year. The latest version may include a payload (i.e. attachment) of a screensaver that is named Valentin.scr. Unfortunately, the message it delivers is not warm-fuzzies from a loved one, but pain and suffering from a virus author.

W32.Yaha is a fairly nasty virus. It is capable of disabling several antivirus and firewall products if it can infect the host systems before it is detected. It is delivered primarily as an e-mail with a script attachment. It even includes its own SMTP server so it can send itself to other victims without relying upon the current victim's e-mail configuration.

Address book

Once a system is infected, W32.Yaha e-mails itself to every contact found in the Windows Address Book, MSN Messenger, .NET Messenger, Yahoo Pager and all files with extensions that contain the letters H and T (such as .htm and .html). The e-mail will contain a subject and body text chosen at random from a list of about 40 "sweetie" or "lover" type messages, along with an inconspicuous looking attachment.

When W32.Yaha infects a system, it copies itself as the following files in the root Windows folder: WinServices.exe, Nav32_loader.exe and Tcpsvs32.exe. It then adds the WinServices.exe filename and pathname to the Run and RunServices keys in the Registry. It also configures the open command to launch itself before any .exe file is executed. Finally, it copies itself into the System folder as one of many names with either a .exe or a .scr extension.

This virus has been ranked in the top five virus threats since it was discovered just before Christmas 2002. It spreads very quickly and can cause moderate to server damage.

The damage caused by this virus is mostly indirect. It can cause a denial of service due to the number of e-mails it generates and its attempt to launch a denial-of-service attack directed toward a specific Pakistani Web site. Plus, if this virus is successful at disabling your antivirus software or firewall, you become vulnerable to every threat on the Internet.

Prevention

Protection against the W32.Yaha virus involves two primary efforts.

First, maintain vigilance on keeping your system secure overall. Second, update your antivirus and firewall software products. Part of this process includes visiting your antivirus software vendor's Web site and downloading a W32.Yaha-specific detection and removal tool.

Experts have also warned users to be wary of unidentified emails, especially those attached with Spanish characters.

They have also alerted Internet shoppers to heed clicks on bogus discount messages from online stores, which may be used to spread viruses.

Suggesting computer users to update their anti-virus software, experts said users must use the real-time computer virus monitoring function while surfing the Internet.

For more information on W32.Yaha.K@mm, visit your antivirus software vendor's site or one of these sites:
• securityresponse.symantec.com/avcenter/
• www.antivirus.com/
• www.centralcommand.com/
• www.mcafee.com/.

Report Your Experience
If you've had a bad experience -- or a good one -- with a consumer product or service, we'd like to hear about it. All complaints are reviewed by class action attorneys and are considered for publication on our site. Knowledge is power! Help spread the word. File your consumer report now.

Share		Follow us on Twitter.

Back to the top |