W32.HLLW.Niden

W32.HLLW.Niden is a worm that attempts to spread itself through file-sharing networks. It also attempts to mass-mail itself to all the contacts in the Windows Address Book. However, due to bugs in the code, the mass-mailing routine does not work properly.

Furthermore, it attempts to disguise itself as Norton Anti-Virus 2003 by using the following icon:

When W32.HLLW.Niden is executed, it displays a fake error message, titled "Error Starting Application." The worm also attempts to delete files belonging to various antivirus programs.

W32.HLLW.Niden is written in the Microsoft Visual Basic (VB) programming language. The VB run-time libraries are required to execute W32.HLLW.Niden.

Protection

• Initial Rapid Release version July 11, 2003
• Latest Rapid Release version July 19, 2008 revision 019
• Initial Daily Certified version July 11, 2003
• Latest Daily Certified version January 20, 2009 revision 048
• Initial Weekly Certified release date July 16, 2003

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Medium

Distribution

• Distribution Level: Medium