Alias:W32.Holar.C@mm, W32/Holar.c@MM [McAfee], W32/Lagel.A [Panda], Win32.Holar.C [CA], WORM_HOLAR.C [Trend], I-Worm.Galil [KAV]
Type:Worm 
Size:54,514 Bytes, 80,626 Bytes 
Origin: 
Date:00-00-0000 
Damage:Sent by email. 
VDF Version:  
Danger:Low 
Distribution:Low 

DistributionThe worm saves the email addresses of the current users in the file C:\%systemdir%\Mmails.dll. It uses its own SMTP engine or Microsoft Outlook, for sending itself to all addresses found on the computer. There can be more worm copies attached to the email. The email looks like this:

Subject: Fwd: Crazy illegal sex !

Body:
Hii Is it really illegal in da USA?
who knows :P
if u have a weak heart i warn u
DON'T see dis Clip.
Emagine two young children havin
crazy sex fo da first time togetha !
loooool i'm still wonderin where thier
parents were? Good ?uck , oh sorry:">
i mean Good Luck :) Bye

Attachment:
iLLeGal.exe

Technical DetailsWhen activated, Worm/Holar.C.1 displays the following message:
"Looooooooool, thanx fo da time u spent thinkin ov me".
Then, the following text appears:
"it was a lil Joke don't be mad :)

The worm copies itself as C:\%SystemDIR%\iLLeGaL.exe and makes the autostart registry entry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices iLLeGaL.exe C:\%SystemDIR%\mplayer.exe

It also enters the following registry key:
HKEY_LOCAL_MACHINE iLLeGal 1

It creates the following files:
-C:\%SystemDIR%\Mplayer.exe ( 13,824 Bytes, hidden)
-C:\%SystemDIR%\SMTP.ocx (25,737 Bytes)
-C:\%SystemDIR%\Mmails.dll (text file)

After finishing the email routine, it pauses for 15 minutes.
Then it overwrites all files in all directories with write access.
The following text is displayed:

Title: ZaCker
Text: No Peace Without war,i hate war but im forced to love it,Hidden Power's gonna b there wherever u r
The overwritten files are all 215 bytes, which contains the following text:
1-No PeaCe WithOut WaR
_
>> TT TT >>> 11>>>OoO>>9\Om
>> TiiT >>> YX >>OOo>>11\Om
>> OXBYL -> Haw >> ()()9.9.12MP
_1s00x05y988z877c7y7756477v77x7777g8oro885t55oro312852oro14P, u
2- Made By ZaCker

The worm deletes all files on drives D E F G.
Description insérée par Crony Walker le mardi 15 juin 2004

Retour . . . .