W32.HLLW.Winevar is a mass-mailing worm that disables some antivirus and firewall programs and drops and executes the W32.FunLove.4099 virus.
Symantec Security Response encourages you to block email attachments that have .pif or .ceo extensions.
W32.HLLW.Winevar arrives in an email that contains three attachments. The names are variable but they will have the format:
- Win<several characters>.Txt (12.6 KB) Music_1.htm
- Win<several characters>.Gif (120 Bytes) Music_2.ceo
- Win<several characters>.pif
The .htm file exploits the
Microsoft VM ActiveX Component vulnerability to register the .ceo extension as an executable file. The email message is formed to take advantage of the
Incorrect MIME Header Can Cause IE to Execute E-mail Attachment vulnerability, but due to a bug in the code, the attachment will not run automatically. Please note that the .htm will be detected as JS.Exception.Exploit.
Click for a more detailed description of Rapid Release and Daily Certified virus definitions.
