W32.HLLW.Loxar

W32.HLLW.Loxar is a worm that spreads using the KaZaA peer-to-peer network. It is written in Delphi and packed by the tElock runtime packer. It copies itself to the root folder of all drives, and to the KaZaA shared folder, using a name chosen randomly from a list that the worm carries. On December 13, the worm might start Notepad and display a message in the window.

The worm attempts to terminate the processes of a number of antivirus and firewall programs.

Protection

• Initial Rapid Release version October 18, 2002
• Latest Rapid Release version August 20, 2008 revision 017
• Initial Daily Certified version October 18, 2002
• Latest Daily Certified version August 20, 2008 revision 016
• Initial Weekly Certified release date October 23, 2002

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Medium

Distribution

• Distribution Level: Medium