1. /
  2. Security Response/
  3. W32.HLLW.Winevar

W32.HLLW.Winevar

Risk Level 2: Low

Discovered:
November 23, 2002
Updated:
February 13, 2007 11:41:16 AM
Also Known As:
W32/Korvar [McAfee], WORM_WINEVAR.A [Trend], I-Worm.Winevar [KAV]
Type:
Worm
Systems Affected:
Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP
CVE References:
CVE-2000-1061 CVE-2001-0154

W32.HLLW.Winevar is a mass-mailing worm that disables some antivirus and firewall programs and drops and executes the W32.FunLove.4099 virus.

Symantec Security Response encourages you to block email attachments that have .pif or .ceo extensions.

W32.HLLW.Winevar arrives in an email that contains three attachments. The names are variable but they will have the format:
  • Win<several characters>.Txt (12.6 KB) Music_1.htm
  • Win<several characters>.Gif (120 Bytes) Music_2.ceo
  • Win<several characters>.pif

The .htm file exploits the Microsoft VM ActiveX Component vulnerability to register the .ceo extension as an executable file. The email message is formed to take advantage of the Incorrect MIME Header Can Cause IE to Execute E-mail Attachment vulnerability, but due to a bug in the code, the attachment will not run automatically. Please note that the .htm will be detected as JS.Exception.Exploit.

Antivirus Protection Dates

  • Initial Rapid Release version November 24, 2002
  • Latest Rapid Release version September 28, 2010 revision 054
  • Initial Daily Certified version November 24, 2002
  • Latest Daily Certified version September 28, 2010 revision 036
  • Initial Weekly Certified release date November 24, 2002
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

  • Wild Level: Medium
  • Number of Infections: 50 - 999
  • Number of Sites: More than 10
  • Geographical Distribution: Low
  • Threat Containment: Moderate
  • Removal: Easy

Damage

  • Damage Level: High

Distribution

  • Distribution Level: High
Writeup By: Peter Ferrie

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
Internet Security Threat Report, Volume 17
Symantec DeepSight Screensaver