Summary
This Lentin (also known as Yaha) worm variant appeared on 16th of September 2003. It is an improved variant comparing to previous versions of the worm. Like its previous variants, this one spreads itself in e-mails, over LAN (local area network), kills tasks of certain programs, logs user's keyboard activities and performs DoS (Denial of Service) attacks on certain sites. The worm can also modify HTML pages on a webserver if it finds it on an infected computer. This variant was most likely a test version of the upcoming Yaha.T worm as some features in this variant were disabled and text strings were not encrypted.