Dangerous Yarner worm targets Outlook

February 20, 2002

Antivirus vendors around the world are warning of a new virus that uses Microsoft Outlook e-mail software to replicate itself by sending out mass e-mail messages that may destroy some Windows files.

The virus, called W32.Yarner.A@mm, masquerades as a legitimate looking newsletter purporting to be from AV website Trojaner-info.de (webmaster@trojaner-info.de) but is actually a dangerous worm.

According to a statement on Trojaner's Web site the worm created by unknown person uses the names of Trojaner' team members Thomas Tietz and Andreas Ebert at the end of the newsletter.

Yarner arrives in an e-mail message with the subject line "Trojaner Info Newsletter". The attached file with this e-mail is yawsetup.exe. If the file is opened, the worm creates a file in the Windows directory with a random name up to 100 characters long and makes certain changes in the registry file to run every time Windows boots up.

The malicious agent spreads as a mass mailing virus, accessing the Microsoft Outlook address book and scanning all .php, .htm, .shtm, .cgi, .pl files in all subdirectories, looking for additional e-mail addresses. Then Yarner uses its own built-in e-mail program to connect to a remote SMTP server in order to forward itself to more unsuspecting victims.

After it has sent copies of itself, the worm then deletes all files in the Windows directory. All users of Outlook 2000 and 2002 should download and install the Security Update.

Users are also strongly recommended not to open attached files in messages without first saving them to hard disk and checking them with updated antivirus software. Contact your antivirus firm to get the most recent antivirus definitions files that include Yarner.