A quick search on www.symantec.com shows that this is a variant of the W32.Yaha.K@mm worm. Go to http:[EMAIL PROTECTED] to get more details, including removal instructions.
Good luck, John >>> "Richard Campbell" 1/2/03 11:10:26 PM >>> Below is original E-mail, and attachment file is Love.scr >From: Lovers Screensavers >To: [EMAIL PROTECTED] >Subject: Free Screenavers of Love >Date: Wed,01 Jan 2003 00:53:38 PM >Attachment: Love.scr Hello, The attached product is send as a part of our official campaign for the popularity of our product. You have been chosen to try a free fully functional sample of our product.If you are satified then you can send it to your friends. All you have to do is to install the software and register an account with us using the links provided in the software. Then send this software to your friends using your account ID and for each person who registers with us through your account, we will pay you $1.5.Once your account reaches the limit of $50, your payment will be send to your registration address by check or draft. Please note that the registration process is completely free which means by participating in this program you will only gain without loosing anything. Best Regards, Admin, &&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&& Besides, the "Hacker" also send her a mail from this e-mail address >From: [EMAIL PROTECTED] >To: [EMAIL PROTECTED] >Subject: Visit us >Date: Tue,31 Dec 2002 23:25:58 PM ################################################################################# Below is what happen when she installed the screen saver.. Any suggestion for me?? yes...when i download that file fr hotmail...it has been scanned . but no virus is detected. then i download and put in my System folder in my Window folder. as screen saver will only can run after save into the System folder. so after i save it in the folder and install it....it has shown in my screen saver - Desktop display..but nothing show..means no screen saver. But i have found a file (notepad) named "yEaHa" something like this..that the contents stated that the main purpose is to spread the yEaHa and they didnt state that he/she is hacker. just that at the bottom stated a email add which is something like [EMAIL PROTECTED] then i have found that all my files in "My Documents" have bcame transparent. and other files in C drive also bcame transparent. and it has ticked "Hidden" in the file property. but i hav unclick it but it still in transparent . In my System folder has a lot of Love icons with diff names like "girls" , "Love xxx" etc. all in Love icons, after i hav installed the file (Love icon) screen svaer file which is named "Friends Happy". >From: "Kazan, Naim" >To: "'Richard Campbell'" >Subject: RE: Is a Virus or Hacker attack?? [7:60114] >Date: Thu, 2 Jan 2003 21:43:31 -0500 > >A friend of mine ran into the same problem downloading some screen saver he >thought his friend sent him. He ended up having the same problem. I think >it >is a hacker installing some kind of worm using your email to send it out on >the internet. > >-----Original Message----- >From: Richard Campbell [mailto:[EMAIL PROTECTED]] >Sent: Thursday, January 02, 2003 9:04 PM >To: [EMAIL PROTECTED] >Subject: Re: Is a Virus or Hacker attack?? [7:60114] > > >thanks for your info.. the strange thing is.. I found she actually get the >attachment from her hotmail not yahoo mail. I thought hotmail scan all the >attachment with latest McAfee AntiVirus??? Besides, she actually >downloaded > >the Norton AntiVirus defination file last month, but now its norton fail to >start > > > >From: "John Neiberger" > >Reply-To: "John Neiberger" > >To: [EMAIL PROTECTED] > >Subject: Re: Is a Virus or Hacker attack?? [7:60114] > >Date: Thu, 2 Jan 2003 17:51:00 GMT > > > >The solution, which both of you really should know, is to have > >up-to-date antivirus software running on any machine that connects to > >the internet in any way. :-) > > > >In the meantime, she could browse to www.symantec.com and run the > >web-based antivirus detection that they have available. Once you > >determine which virus she is infected with you can get more details > >about how to remove it correctly. Regardless, she should run--not > >walk--to the nearest computer store and buy Norton AntiVirus of some > >other AV software, and make sure she keeps her virus definitions > >up-to-date. > > > >Regards, > >John > > > > >>> "Richard Campbell" 1/2/03 10:34:01 AM >>> > >Hi... Group, > > > >I have a friend who received a mail containing screen saver attachment > >in > >her yahoo mail account when she is surf net at home. She downloaded > >the > >screen saver and install it. After installing , she found that her > >files in > >the my document become transparent in color and there are many extra > >files > >in many places. Besides, she also found a notepad file in the desktop, > > > >stating that she had been hacked, yeah.. (something like that) and it > >can't > >be deleted (It will come back after rebooting). And its sound also > >gone. > >Anyone encountered this so called Hacker "Virus" before?? Any solution > >for > >me?? > > > >Thanks in advanced > > > > > > > > > > > > > >_________________________________________________________________ > >The new MSN 8 is here: Try it free* for 2 months > >http://join.msn.com/?page=dept/dialup >_________________________________________________________________ >MSN 8 helps eliminate e-mail viruses. Get 2 months FREE* >http://join.msn.com/?page=features/virus _________________________________________________________________ MSN 8: advanced junk mail protection and 2 months FREE*. http://join.msn.com/?page=features/junkmail Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=60214&t=60114 -------------------------------------------------- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
