Find a Partner
This window is encrypted for your security.
Need help? Ask the community or hire an expert.
Go to Avira Answers
W32.Holar.C@mm, W32/Holar.c@MM [McAfee], W32/Lagel.A [Panda], Win32.Holar.C [CA], WORM_HOLAR.C [Trend], I-Worm.Galil [KAV]
54,514 Bytes, 80,626 Bytes
Sent by email.
The worm saves the email addresses of the current users in the file C:\%systemdir%\Mmails.dll. It uses its own SMTP engine or Microsoft Outlook, for sending itself to all addresses found on the computer. There can be more worm copies attached to the email. The email looks like this:
Subject: Fwd: Crazy illegal sex !
Hii Is it really illegal in da USA?
who knows :P
if u have a weak heart i warn u
DON'T see dis Clip.
Emagine two young children havin
crazy sex fo da first time togetha !
loooool i'm still wonderin where thier
parents were? Good ?uck , oh sorry:">
i mean Good Luck :) Bye
When activated, Worm/Holar.C.1 displays the following message:
"Looooooooool, thanx fo da time u spent thinkin ov me".
Then, the following text appears:
"it was a lil Joke don't be mad :)
The worm copies itself as C:\%SystemDIR%\iLLeGaL.exe and makes the autostart registry entry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices iLLeGaL.exe C:\%SystemDIR%\mplayer.exe
It also enters the following registry key:
HKEY_LOCAL_MACHINE iLLeGal 1
It creates the following files:
-C:\%SystemDIR%\Mplayer.exe ( 13,824 Bytes, hidden)
-C:\%SystemDIR%\SMTP.ocx (25,737 Bytes)
-C:\%SystemDIR%\Mmails.dll (text file)
After finishing the email routine, it pauses for 15 minutes.
Then it overwrites all files in all directories with write access.
The following text is displayed:
Text: No Peace Without war,i hate war but im forced to love it,Hidden Power's gonna b there wherever u r
The overwritten files are all 215 bytes, which contains the following text:
1-No PeaCe WithOut WaR
>> TT TT >>> 11>>>OoO>>9\Om
>> TiiT >>> YX >>OOo>>11\Om
>> OXBYL -> Haw >> ()()9.9.12MP
2- Made By ZaCker
The worm deletes all files on drives D E F G.
Description inserted by Crony Walker on Tuesday, June 15, 2004