JS.Yamanner - Spreads via Yahoo's free email service
http://secunia.com/virus_information/29782/js.yamanner/
http://www.sarc.com/avcenter/venc/data/js.yamanner@m.html

More info: Yahoo Mail Worm Harvesting Addresses

Here's PCWorld's info:

http://www.pcworld.com/resource/article/0,...,RSS,RSS,00.asp

Thankfully, I use Gmail!

Last Updated: 2006-06-12 21:19:00
http://isc.sans.org/diary.php?compare=1&storyid=1398

Edit: To clarify, the Yamanner worm does not send itself as an attachment, it resides inside the e-mail body. The worm activates automatically by just opening an infected e-mail message with Internet Explorer. It uses a 0-day vulnerability in Yahoo! webmail system.

Just received this from our network Administrator (no link was provided).

So here is the question that I have looked all over for, but have not been able to find a direct answer to:

Does this worm only run when an infected e-mail is opened?

Or, does something get installed locally on the PC that will cause all future e-mails to be infected?

One other one: The solution that Yahoo sent out, was it sent via e-mail? If so, and one deleted it, is there anyway to get a copy?

Thanks for any help.

The message will have a From" address of av3@yahoo.com and a Subject: of "New Graphic Site."

It is recommended that you block the address "av3@yahoo.com"

The worm does not send itself as an attachment, it resides inside the e-mail body. The worm activates automatically by just opening an infected e-mail message with Internet Explorer.

Since the solution was automatically distributed, I would say yes by email. I will check around some more to see where else its available and let you know if I find anything.

I understand that it is in the e-mail itself, and not an attachment. When the Javascript runs, is anything installed locally?

There are no other related malware files installed if that's what your asking about. When the script runs it sends a copy of itself to email addresses gathered from the Yahoo email folders. Harvested addresses from the address book are then submitted to a remote URL, which is likely to be used for a spam database...technical details here.

Thanks Quietman, that's exactly what I was asking about. I find it interesting that Symantec has you turn system restore off and run a full system scan. It looks like that is a waste of time.

Yahoo quickly steps on e-mail worm

Today I got an email from myself saying that I had a site dealing with electronics. The email went to everyone in my address book.

The original Yamanner seemed to target only yahoo sites with hope of further spreading whatever it is they are spreading. This one targeted everyone in my address book. I did an immediate scan -- several different ones and my XP came up clean on all counts. Yamanner was said to be a script that once the email was opened would "infect" the Yahoo account.

The subject line was "HI" and there were some links in the email. Comments on the original were that they had to do with a graphics site. I don't t remember seeing anything like that and generally just zap things that look strange before opening. I have reported this to Yahoo but no reply yet.

Anyone else seen this or am I special?