W32.HLLW.Efno

Risk Level 1: Very Low

Printer Friendly Page|Rate this page

Discovered:: September 13, 2002
Updated:: February 13, 2007 11:49:37 AM
Also Known As:: W32.Efno.Worm
Type:: Worm
Systems Affected:: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP

W32.HLLW.Efno is a worm that attempts to spread using the popular KaZaA file-sharing program. The worm is written in Visual Basic, and therefore it requires Visual Basic runtime libraries (Msvbvm60.dll) to run.

When this worm runs, it changes several KaZaA registry keys. This causes the worm to be accessible to other users on the KaZaA network. The worm spreads using the file name "Win XP SP1 cracker.exe." However, it is possible to change the file name to other names that may appeal to people.

NOTE: If KaZaA is not installed on the computer, this worm does nothing.

NOTE: Virus definitions dated prior to September 16, 2002 may detect this as W32.Efno.Worm

Antivirus Protection Dates

Initial Rapid Release version September 16, 2002
Latest Rapid Release version September 28, 2010 revision 054
Initial Daily Certified version September 16, 2002
Latest Daily Certified version September 28, 2010 revision 036
Initial Weekly Certified release date September 18, 2002

Click for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

Wild Level: Low
Number of Infections: 0 - 49
Number of Sites: 0 - 2
Geographical Distribution: Low
Threat Containment: Easy
Removal: Easy

Damage

Damage Level: Low

Distribution

Distribution Level: Low

Writeup By: Neal Hindocha

Removal

Search Threats

Search by name

Example: W32.Beagle.AG@mm

Internet Security Threat Report, Volume 16