Virus Lentin (Yaha)
Lentin is a mass-mailing worm that sends itself to all email addresses that he can found on computer.
The worm copies itself to C:\Recycled and to the %Windows% folder.
The worm sends itself as email with attachment. The attachment has a .bat, .pif or .scr file extension.
The worm configures itself to execute each time that an .exe file is executed by changing the default value of the registry key
HKEY_LOCAL_MACHINE\Software\Classes\exefile\shell\open\command
from
"%1" %*
to
C:\Recycled\WormName %1 %*
It also attempts to terminate antivirus and firewall processes. It does not terminate AnVir Virus Destroyer.
© Copyright 2000-2008 AnVir Software. All Rights Reserved.
