Win32/Yaha

Drop multiple copies of itself with various names to locations such as <system folder>, %windir%, <recycle folder>. It also copies itself to <startup folder>.

Modify the registry as follows:

Spread through e-mail. The worm gathers e-mail addresses from the computer and saves them to a file. The worm sends a copy of itself as an e-mail attachment to those addresses. Due to an Internet Explorer vulnerability, the e-mail attachment can run automatically when the user previews or views the e-mail containing the attachment. Installing MS01-020 or MS01-027 patches this vulnerability, but the patch does not prevent the worm from running if the user opens the attachment.

Terminate processes and close windows for system utilities such as Task Manager.

Copy itself to all mapped drives.

Copy itself to all writeable network shares. It may add a line in the win.ini file on the network share host computer such as:
run = <worm copy file name>

Perform denial of service (DoS) attacks against certain Web sites.

Display several text messages in sequence or display an image of shaking words to look like a screensaver.