Related Resources • Virus Encyclopedia • Glossary of terms

Elsewhere on the Web • F-Secure Description • MessageLabs Threatlist

Discovered on June 20, 2002, the Yaha.E worm, a.k.a. Lentin, quickly closed in on the heels of the Klez.H and Klez.E worms, claiming the number three spot on the MessageLabs ThreatList as of June 27, 2002. Yaha.E is a mass-mailing email worm featuring a complex composition routine comprised of over 40 subject line choices or a combination of dozens of others. This makes identification or filtering by subject line a challenge. According to F-Secure, Yaha can also select from a range of other criteria in order to compose its message body. Upon infection, the worm modifies the registry, constantly checking and refreshing the key to ensure that it runs each time an EXE program is started. This constant checking and refreshing makes manually removing the worm extremely difficult. Additionally, Yaha.E searches for and terminates the processes of several antivirus and security programs, as well as competing viruses Sircam and Klez.