W32.HLLW.Nautic

W32.HLLW.Nautic is a worm that creates and shares a folder on the network. The worm then copies itself to this folder as a file name that is designed to trick users into executing the malicious files. Some of the possible file names are as follows:

• Windows XP Crack.exe
• Warcraft III Trainer (Cheats).exe
• Norton Antivirus 2003 Installer.exe
• Bikini Girls.exe
• Halflife Patch.exe
• Funny Screensaver.exe
• Hack Hotmail Account.exe
• Age of Empires II_Keygen(Serial).exe
• Warcraft III - Crack.exe
• Winzip 8.2 (Beta 3) Full Version Installer.exe
• Playboy_Screensaver_Install.exe

The worm also listens for commands on one of the following ports:

• 335
• 2281
• 5679
• 9148

Protection

• Initial Rapid Release version August 30, 2002
• Latest Rapid Release version August 30, 2002
• Initial Daily Certified version August 30, 2002
• Latest Daily Certified version August 30, 2002
• Initial Weekly Certified release date September 4, 2002

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Low

Distribution

• Distribution Level: Medium