Discovered: August 29, 2002
Updated: February 13, 2007 11:57:34 AM
Also Known As: BKDR_NAUTIC.A [Trend], Worm.Win32.Nautical [AVP]
Type: Worm
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP
W32.HLLW.Nautic is a worm that creates and shares a folder on the network. The worm then copies itself to this folder as a file name that is designed to trick users into executing the malicious files. Some of the possible file names are as follows:
- Windows XP Crack.exe
- Warcraft III Trainer (Cheats).exe
- Norton Antivirus 2003 Installer.exe
- Bikini Girls.exe
- Halflife Patch.exe
- Funny Screensaver.exe
- Hack Hotmail Account.exe
- Age of Empires II_Keygen(Serial).exe
- Warcraft III - Crack.exe
- Winzip 8.2 (Beta 3) Full Version Installer.exe
- Playboy_Screensaver_Install.exe
The worm also listens for commands on one of the following ports:
Protection
-
Initial Rapid Release version August 30, 2002
-
Latest Rapid Release version August 30, 2002
-
Initial Daily Certified version August 30, 2002
-
Latest Daily Certified version August 30, 2002
-
Initial Weekly Certified release date September 4, 2002
Click for a more detailed description of Rapid Release and Daily Certified virus definitions.
Threat Assessment
Wild
-
Wild Level: Low
-
Number of Infections: 0 - 49
-
Number of Sites: 0 - 2
-
Geographical Distribution: Low
-
Threat Containment: Easy
-
Removal: Easy
Damage
Distribution
-
Distribution Level: Medium
Writeup By: Douglas Knowles