Just the other day, a customer called to ask how they could tell when it was safe to open attachments received via e-mail. They thought that they only opened them when they came from someone they knew, but managed to get the KLEZ virus infecting their computer when they opened a file from a known friend's computer. As it turns out, the friend whom they thought sent the file wasn't actually infected, it was the KLEZ virus spoofing their friend's address from another PC.

A new virus trying to catch up with the KLEZ is the YAHA.E virus. It acts similar to the other virus, but has moved up to number three on the chart of most active viruses. Discovered on June 20, 2002, the Yaha.E worm, a.k.a. Lentin, quickly closed in on the heels of the Klez.H and Klez.E worms, claiming the number three spot on the MessageLabs ThreatList as of June 27, 2002. Yaha.E is a mass-mailing e-mail worm featuring a complex composition routine comprised of over 40 subject line choices or a combination of dozens of others. It sends itself to all e-mail addresses that exist in the Microsoft Windows Address Book, the MSN Messenger List, the Yahoo Pager list, the ICQ list, and files that have extensions that contain the letters ht (usually found in Windows 98/ME/2000/XP systems). 

Identification or filtering by subject line is a challenge. According to F-Secure, Yaha can also select from a range of other criteria in order to compose its message body. Upon infection, the worm modifies the registry, constantly checking and refreshing the key to ensure that it runs each time an EXE program is started. This constant checking and refreshing makes manually removing the worm extremely difficult. Additionally, Yaha.E searches for and terminates the processes of several antivirus and security programs, such as Norton and McAfee Anti-virus, as well as competing viruses Sircam and Klez.

The worm randomly chooses the subject and body of the e-mail message. The attachment will have a .bat, .pif or .scr file extension. Depending upon the name of the Recycled folder, the worm either copies itself to that folder or to the %Windows% folder. The Yaha.E message body can contain a variety of text strings referring to the attached file, including: "Check the attachment", "See the attachement", "Enjoy the attachement", "More details attached", "Attached one Gift for u.." and "wOW CHECK THIS". The message may appear to be a FW: message, using a fake sender in for the From address and the infected users e-mail address for the To address. The FW: message may appear as either a fake undeliverable message report or a fake screensaver subscription message. The name of the file that the worm creates might simply consist of four randomly generated characters between c and y.

Free removal tools for both of these viruses and others are available from Norton's website, and many others mentioned in previous articles.

Now for the topic I promised you last month. What to do with those old computers?

The other day I drove down a residential street in my neighborhood and found two older laser jet printers sitting on the sidewalk, next to a small stack of old computer cases. I've seen this from time to time, along with dead monitors sitting on the side of the road looking for a new home. What most folks don't realize is that city trash won't pick them up, and that it's actually against TNRC regulations to put such items into the normal trash. Most city trash crews will not pick up these items, no more than they would your old refrigerator or stove unless you called, and pay for, a special trash pickup.

So the question remains, what do you do with them? Some folks donate them to their church, a low income day care operation, Goodwill, Salvation Army, or one of the charity thrift stores for resale if they are still in working conditions. Others obviously stick them on the curb in the hopes that someone will come along and steal them, thus solving their problem for them. 

I can remember years ago, when my (now 20 year old) son was first discovering a screw driver. I would give him the old computers, printers, but not monitors, and tell him to tear them apart to salvage the screws and little pieces parts so I could use them on other computers. This is back in the days when a 386 might have 4MB of ram with a 20MB hard drive that you thought was really hot (and expensive)!

There are approximately eighty different plastics used in the manufacturer of monitor cases alone, all are non-biodegradable. Some have metallic compounds to act as electromagnetic screening, others have specialized catalysts. There is no standard for the monitor casing industry at present time, but obviously you don't want your monitor sitting on your desk, ready to dissolve when you spill your coffee on it next time either.

But I discovered a better solution a couple of years ago. Corona Visions is a company in the business of recycling and refurbishing old computer components. Corona Visions accepts used electronic components of many types, but the subject of this article is your old monitor, computer and printers. Corona Visions takes the old parts, fixes some for resale and recycles the rest. You can often find a really cheap (by any definition of that word) used computers from them, often for under $200 with a monitor included. They clean up, repair and test them before selling. 

Corona Visions is located in an old (recycled) warehouse behind the new Bexar County Appraisal District's office, at Martin and Medina just northwest of the downtown area near the county jail. Turn south on Medina from Martin and look for a loading dock area on the side of the white warehouse. Their phone number is 210-521-7612 or visit their web site  for more information. It's worth a trip to visit their warehouse just to see the operation, or to pick up a used computer for the kids at recycled prices.