Find a Partner
This window is encrypted for your security.
Need help? Ask the community or hire an expert.
Go to Avira Answers
I-Worm/Hawawi.e, W32/Holar, W32,Hawawi.Worm
Spreads by email and shared networks.
The worm collects email addresses from computer files. The collected data is saved, for example, with the following registry entries: HKEY_CURRENT_CONFIG\System "Emails1" = harvested address HKEY_CURRENT_CONFIG\System "Emails2" = next harvested addressetc etc
The worm uses its own SMTP engine for sending emails. The email sent by the worm has the following structure:
Love Speaks it all
Wow But not for Now
y0 Ain't Got Shyt !
Why Do We FOk?
what does it look likt?
did u get it?
Why did u send me this shyt?
Try this great program allowing u to translate 100 languages .
just write a passage in english and chose a language to get the traslation
one of my friends used it with his arabian gf and it worked successfully ;)
so , Now we can say ' Love Speaks it All ' :)
i thing the subject is enough to describe the attached file !
check it out and replay your opinion
You're gonna love it ;)
delete it after reading , Professor :P
i've got this surprise from a friend :)
it really deserves a few minutes of your time.
Should i email u first to email me?
u don't know how much ur emails mean to me.
i wish u like this email and plzz don't forget me :)
coz i couldn't get the other part of it , any way , check it out having alil thing is better than nothing :P
All u can get is burning ur self Coz all we can do is to watch, nothing for us to touch :(
let me answer ,,, hummmmmmmmm
Coz we Burn Our selves by watching ********** like the one i attached :P
Hummm , It looks like something men can't live with out ha?
if not , enjoy ur Eyes by Seeing it ;)
THANX BUT I DON'T ACCEPT SEX MATERIALS FROM STRANGERS. I SAW THEM N I WONDERED HOW U COULD DO SO ? I REATTCH THE SHYT U SENT PLEASE DON'T EMAIL ME
The worm is also able to spread over P2P networks. Thus, the worm multiplies itself under tempting file names into %Systemdir% directory. All these files are read-only and hidden. It uses the following names:
The worm is based on the following 4 files:
DROPPER COMPONENT | SPREADING COMPONENT | SMTP LIBRARY | ICQ SPREADING COMPONENT
Its files are hidden. For ensuring this, the worm enters into the registry:
The spreading component is written into %SystemDIR% as 'MEDIA PLAYER.EXE' (26,112 Bytes)and entered into the registry for autostart:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "Ioadqm" = C:\%WinDIR%\%SystemDIR%\MEDIA PLAYER.exe
The ICQ spreading component is written into %SystemDIR% as "SYS32 .EXE" (10,258 Bytes).
The worm can copy itself in C:\ using already existing file names and replacing their extensions with '.PIF'.
The worm has a highly destructive routine. All files of the following types are reduced to 0 Bytes:
htm html zip doc mdb xls txt ppt pps mpg jpg pdf rar ram mp3 frm dpr php cpp swf sql mde wav rm mpeg P2P Propagation
Description inserted by Crony Walker on Tuesday, June 15, 2004