W32.HLLW.Backzat.C

W32.HLLW.Backzat.C is a mass-mailing worm that uses Microsoft Outlook to send itself to all the contacts in the Microsoft Outlook Address Book. It also attempts to spread itself through the Grokster, eDonkey2000, BearShare, Morpheus, and KaZaA file-sharing networks.

This worm may distribute itself through the mapped drives AIM95, mIRC, and ICQ. It also deletes the security software from your computer when it is executed.

The email has the following characteristics:

Subject: Heyhey!
Message: Ya know man, I've seen funny things in my life but this screen saver beats them all, You have to check this out.
Attachment: BBbLWDB.Scr

This threat is written in the Microsoft Visual C++ programming language and is compressed with UPX.

When W32.HLLW.Backzat.C runs, it displays a fake message titled "Error." See the "Technical Details" section for an illustration.

Protection

• Initial Rapid Release version January 4, 2003
• Latest Rapid Release version July 19, 2008 revision 019
• Initial Daily Certified version January 4, 2003
• Latest Daily Certified version January 20, 2009 revision 048
• Initial Weekly Certified release date January 8, 2003

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Medium

Distribution

• Distribution Level: High