Alias:I-Worm/Hawawi.e, W32/Holar, W32,Hawawi.Worm
Type:Worm 
Size:58,009 Bytes 
Origin: 
Date:00-00-0000 
Damage:Spreads by email and shared networks. 
VDF Version:  
Danger:Low 
Distribution:Low 

DistributionThe worm collects email addresses from computer files. The collected data is saved, for example, with the following registry entries: HKEY_CURRENT_CONFIG\System "Emails1" = harvested address HKEY_CURRENT_CONFIG\System "Emails2" = next harvested addressetc etc
The worm uses its own SMTP engine for sending emails. The email sent by the worm has the following structure:

Subject:
Love Speaks it all
Co0o0o0o0oL
Fw:
Heeeeeeeeeeeeeeeey
Wussaaaaaaaap?
Wow But not for Now
y0 Ain't Got Shyt !
Why Do We FOk?
what does it look likt?
did u get it?
Why did u send me this shyt?

Body:

Hii
Try this great program allowing u to translate 100 languages .
just write a passage in english and chose a language to get the traslation
one of my friends used it with his arabian gf and it worked successfully ;)
so , Now we can say ' Love Speaks it All ' :)

i thing the subject is enough to describe the attached file !
check it out and replay your opinion
Cya

You're gonna love it ;)
delete it after reading , Professor :P

i've got this surprise from a friend :)
it really deserves a few minutes of your time.
Bye

Should i email u first to email me?
u don't know how much ur emails mean to me.
i wish u like this email and plzz don't forget me :)

coz i couldn't get the other part of it , any way , check it out having alil thing is better than nothing :P

All u can get is burning ur self Coz all we can do is to watch, nothing for us to touch :(

let me answer ,,, hummmmmmmmm
Coz we Burn Our selves by watching ********** like the one i attached :P

Hummm , It looks like something men can't live with out ha?

if not , enjoy ur Eyes by Seeing it ;)

THANX BUT I DON'T ACCEPT SEX MATERIALS FROM STRANGERS. I SAW THEM N I WONDERED HOW U COULD DO SO ? I REATTCH THE SHYT U SENT PLEASE DON'T EMAIL ME

The worm is also able to spread over P2P networks. Thus, the worm multiplies itself under tempting file names into %Systemdir% directory. All these files are read-only and hidden. It uses the following names:
Aint_it_Funny.pif
Anal_Sex_Ass_fxxxing.pif
AniMaL_N_Burning_Ladies.pif
Asian_girls.pif
Beauty_VS_Your_FaCe.pif
Big_txxx_bxxxx_Pxxxies.pif
Black_babes.pif
Broke_ass.pif
Come_2_Cxx.pif
cute_Gays.pif
Endless_life.pif
Famous_PpL_N_Bad_Setuations.pif
FASS.mpeg
Gurls_Secrets.pif
HardCore_Amature_Naked_nude.pif
HaWaWi.pif
HaWawi_N_Hawaii.pif
Hearts_translator.pif
Hot_Show.pif
Hot_teen_Virgin.pif
How_to_improve_ur_love.pif
Leaders_Scandals.pif
LeSbian_Girls_Lesbo_gay.pif
Lo0o0o0o0oL.pif
Music_downloader.pif
Old_women_Sex.pif
Real_Magic.pif
SeXy_LaDies_Gettin_fxxxed.pif
Shakira_ass.pif
Shakiraz_Big_ass.pif
Short_vClip.pif
Show_clip_mpeg_movie.pif
SmtpMailer.dll
Sweet_but_smilly.pif
Sys32 .exe
Tears_of_Happiness.pif
Tedious_SeX.pif
Teenz_Rxxxr.pif
The_Truth_of_Love.pif
unfaithful_Gurls.pif
Wet_pxxxxes.pif
Wet_pxxxx_huge_cxxx_nice_dxxx.pif
White_AmeRica.pif
XxX_Mpegs_Downloader.pif
Young_teen_Having_Sex.pif

Technical DetailsThe worm is based on the following 4 files:
DROPPER COMPONENT | SPREADING COMPONENT | SMTP LIBRARY | ICQ SPREADING COMPONENT
Its files are hidden. For ensuring this, the worm enters into the registry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AdvancedDie

The spreading component is written into %SystemDIR% as 'MEDIA PLAYER.EXE' (26,112 Bytes)and entered into the registry for autostart:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "Ioadqm" = C:\%WinDIR%\%SystemDIR%\MEDIA PLAYER.exe

The ICQ spreading component is written into %SystemDIR% as "SYS32 .EXE" (10,258 Bytes).

The worm can copy itself in C:\ using already existing file names and replacing their extensions with '[2].PIF'.

The worm has a highly destructive routine. All files of the following types are reduced to 0 Bytes:
htm html zip doc mdb xls txt ppt pps mpg jpg pdf rar ram mp3 frm dpr php cpp swf sql mde wav rm mpeg P2P Propagation
Description insérée par Crony Walker le mardi 15 juin 2004

Retour . . . .