Win32.Yahaa.E@mm

( Win32/Yahaa.F@mm )

SYMPTOMS:

It presents the same symptoms as Win32.Yahaa.D@mm

TECHNICAL DESCRIPTION:

This is a slightly modified version of Win32.Yahaa.D@mm

The differences are:
- Yahaa.E is flooding the following URL: http://www.pak.gov.pk
- It searches for e-mail addresses in all versions of ICQ

Removal instructions:

Important: You will have to close all applications before running the
tool (including the antivirus shields) and to restart the computer afterwards.
Additionally you\'ll have to manually delete the infected files located in archives
and the infected messages from your mail client.

The BitDefender AntiYahaa tool does the following:
- it detects all versions of Win32.Yahaa;
- it deletes the files created by Win32.Yahaa;
- it kills the process from memory;
- it repairs the Windows registry.

ANALYZED BY:

Sorin Victor Dudea
BitDefender Virus Researcher