W32.HLLW.Pluto

W32.HLLW.Pluto is a mass-mailing worm that uses the default email program or its own SMTP engine to send itself to all contacts in the Windows Address Book, Microsoft Outlook Address Book, and to email addresses that it retrieves from .htm files. It may spread through some file-sharing networks, such as eDonkey2000, Morpheus, Xolox, KaZaA, Shareaza, and LimeWire.

When the worm arrives by email, the worm uses a MIME exploit that allows the worm to be executed when you read or preview the file. Information about his exploit and a patch are available at http://www.microsoft.com/technet/security/bulletin/MS01-020.asp.

This threat is written in the Borland Delphi programming language and is compressed with UPX.