Worm/Hawawi.G.Drp - Worm

See also

Full description

Alias:	I-Worm/Hawawi.e, W32/Holar, W32,Hawawi.Worm
Type:	Worm
Size:	58,009 Bytes
Origin:
Date:	00-00-0000
Damage:	Spreads by email and shared networks.
VDF Version:
Danger:	Low
Distribution:	Low

DistributionThe worm collects email addresses from computer files. The collected data is saved, for example, with the following registry entries: HKEY_CURRENT_CONFIG\System "Emails1" = harvested address HKEY_CURRENT_CONFIG\System "Emails2" = next harvested addressetc etc
The worm uses its own SMTP engine for sending emails. The email sent by the worm has the following structure:

Subject:
Love Speaks it all
Co0o0o0o0oL
Fw:
Heeeeeeeeeeeeeeeey
Wussaaaaaaaap?
Wow But not for Now
y0 Ain't Got Shyt !
Why Do We FOk?
what does it look likt?
did u get it?
Why did u send me this shyt?

Body:

Hii
Try this great program allowing u to translate 100 languages .
just write a passage in english and chose a language to get the traslation
one of my friends used it with his arabian gf and it worked successfully ;)
so , Now we can say ' Love Speaks it All ' :)

i thing the subject is enough to describe the attached file !
check it out and replay your opinion
Cya

You're gonna love it ;)
delete it after reading , Professor :P

i've got this surprise from a friend :)
it really deserves a few minutes of your time.
Bye

Should i email u first to email me?
u don't know how much ur emails mean to me.
i wish u like this email and plzz don't forget me :)

coz i couldn't get the other part of it , any way , check it out having alil thing is better than nothing :P

All u can get is burning ur self Coz all we can do is to watch, nothing for us to touch :(

let me answer ,,, hummmmmmmmm
Coz we Burn Our selves by watching ********** like the one i attached :P

Hummm , It looks like something men can't live with out ha?

if not , enjoy ur Eyes by Seeing it ;)

THANX BUT I DON'T ACCEPT SEX MATERIALS FROM STRANGERS. I SAW THEM N I WONDERED HOW U COULD DO SO ? I REATTCH THE SHYT U SENT PLEASE DON'T EMAIL ME

The worm is also able to spread over P2P networks. Thus, the worm multiplies itself under tempting file names into %Systemdir% directory. All these files are read-only and hidden. It uses the following names:
Aint_it_Funny.pif
Anal_Sex_Ass_fxxxing.pif
AniMaL_N_Burning_Ladies.pif
Asian_girls.pif
Beauty_VS_Your_FaCe.pif
Big_txxx_bxxxx_Pxxxies.pif
Black_babes.pif
Broke_ass.pif
Come_2_Cxx.pif
cute_Gays.pif
Endless_life.pif
Famous_PpL_N_Bad_Setuations.pif
FASS.mpeg
Gurls_Secrets.pif
HardCore_Amature_Naked_nude.pif
HaWaWi.pif
HaWawi_N_Hawaii.pif
Hearts_translator.pif
Hot_Show.pif
Hot_teen_Virgin.pif
How_to_improve_ur_love.pif
Leaders_Scandals.pif
LeSbian_Girls_Lesbo_gay.pif
Lo0o0o0o0oL.pif
Music_downloader.pif
Old_women_Sex.pif
Real_Magic.pif
SeXy_LaDies_Gettin_fxxxed.pif
Shakira_ass.pif
Shakiraz_Big_ass.pif
Short_vClip.pif
Show_clip_mpeg_movie.pif
SmtpMailer.dll
Sweet_but_smilly.pif
Sys32 .exe
Tears_of_Happiness.pif
Tedious_SeX.pif
Teenz_Rxxxr.pif
The_Truth_of_Love.pif
unfaithful_Gurls.pif
Wet_pxxxxes.pif
Wet_pxxxx_huge_cxxx_nice_dxxx.pif
White_AmeRica.pif
XxX_Mpegs_Downloader.pif
Young_teen_Having_Sex.pif

Technical DetailsThe worm is based on the following 4 files:
DROPPER COMPONENT | SPREADING COMPONENT | SMTP LIBRARY | ICQ SPREADING COMPONENT
Its files are hidden. For ensuring this, the worm enters into the registry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AdvancedDie

The spreading component is written into %SystemDIR% as 'MEDIA PLAYER.EXE' (26,112 Bytes)and entered into the registry for autostart:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "Ioadqm" = C:\%WinDIR%\%SystemDIR%\MEDIA PLAYER.exe

The ICQ spreading component is written into %SystemDIR% as "SYS32 .EXE" (10,258 Bytes).

The worm can copy itself in C:\ using already existing file names and replacing their extensions with '[2].PIF'.

The worm has a highly destructive routine. All files of the following types are reduced to 0 Bytes:
htm html zip doc mdb xls txt ppt pps mpg jpg pdf rar ram mp3 frm dpr php cpp swf sql mde wav rm mpeg P2P Propagation

See a brief description here.

Description inserted by Crony Walker on Tue, 15 Jun 2004 14:00 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back