Related Resources • Naming the Worm • Yaha Messages • What Yaha Does • Removing Yaha • Virus Encyclopedia • Glossary of terms

Due to the manner in which certain Yaha variants refresh themselves, manual removal of the worm may not be possible for many people. In addition, because of its penchant for disabling antivirus software, disinfection - or even detection - may not be automatically possible. Fortunately, antivirus vendors' McAfee, Sophos, and Symantec have provided special tools that will detect and remove the Yaha variants from infected systems.

McAfee AVERT Stinger (removes Yaha, Bugbear, Elkern, and Klez)
McAfee AVERT Stinger Review
Sophos Removal Tool
Symantec Removal Tool

Alternatively, infected users might wish to try running Trend Micro's Housecall, an online virus scanner that is not affected by the Yaha worm. Scanning with Housecall is free, and provides a valuable second opinion even when your existing antivirus software is running perfectly. Of course, it is recommended that the realtime component of your installed antivirus be temporarily disabled prior to running Housecall, though in the case of a Yaha infection this may have already occurred without your knowledge. To access Trend's free Housecall service, visit http://housecall.antivirus.com/.

Of course, preventing infection in the first place is the best plan of attack. To do so, you may follow the steps outlined for your mail client in the Email Help Center or using a filtering products such as MailDefense which will automatically remove harmful attachments and potentially malicious email content. You should also pay regular visits to the Windows Update site to ensure you have the latest security patches applied for your system.