Worm/Holar.C.1 - Worm

See also

Full description

Alias:	W32.Holar.C@mm, W32/Holar.c@MM [McAfee], W32/Lagel.A [Panda], Win32.Holar.C [CA], WORM_HOLAR.C [Trend], I-Worm.Galil [KAV]
Type:	Worm
Size:	54,514 Bytes, 80,626 Bytes
Origin:
Date:	00-00-0000
Damage:	Sent by email.
VDF Version:
Danger:	Low
Distribution:	Low

DistributionThe worm saves the email addresses of the current users in the file C:\%systemdir%\Mmails.dll. It uses its own SMTP engine or Microsoft Outlook, for sending itself to all addresses found on the computer. There can be more worm copies attached to the email. The email looks like this:

Subject: Fwd: Crazy illegal sex !

Body:
Hii Is it really illegal in da USA?
who knows :P
if u have a weak heart i warn u
DON'T see dis Clip.
Emagine two young children havin
crazy sex fo da first time togetha !
loooool i'm still wonderin where thier
parents were? Good ?uck , oh sorry:">
i mean Good Luck :) Bye

Attachment:
iLLeGal.exe

Technical DetailsWhen activated, Worm/Holar.C.1 displays the following message:
"Looooooooool, thanx fo da time u spent thinkin ov me".
Then, the following text appears:
"it was a lil Joke don't be mad :)

The worm copies itself as C:\%SystemDIR%\iLLeGaL.exe and makes the autostart registry entry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices iLLeGaL.exe C:\%SystemDIR%\mplayer.exe

It also enters the following registry key:
HKEY_LOCAL_MACHINE iLLeGal 1

It creates the following files:
-C:\%SystemDIR%\Mplayer.exe ( 13,824 Bytes, hidden)
-C:\%SystemDIR%\SMTP.ocx (25,737 Bytes)
-C:\%SystemDIR%\Mmails.dll (text file)

After finishing the email routine, it pauses for 15 minutes.
Then it overwrites all files in all directories with write access.
The following text is displayed:

Title: ZaCker
Text: No Peace Without war,i hate war but im forced to love it,Hidden Power's gonna b there wherever u r
The overwritten files are all 215 bytes, which contains the following text:
1-No PeaCe WithOut WaR
_
>> TT TT >>> 11>>>OoO>>9\Om
>> TiiT >>> YX >>OOo>>11\Om
>> OXBYL -> Haw >> ()()9.9.12MP
_1s00x05y988z877c7y7756477v77x7777g8oro885t55oro312852oro14P, u
2- Made By ZaCker

The worm deletes all files on drives D E F G.

See a brief description here.

Description inserted by Crony Walker on Tue, 15 Jun 2004 14:00 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back