W32.HLLW.Oror.D@mm

W32.HLLW.Oror.D@mm is a mass-mailing worm and a variant of W32.HLLW.Oror@mm. This worm attempts to spread through email, mIRC, KaZaA, network shares, and mapped drives. W32.HLLW.Oror.D@mm also attempts to terminate and remove various security products from an infected computer.

W32.HLLW.Oror.D@mm is written in the C++ language and is compressed with UPX. The uncompressed size is approximately 160 KB.

Protection

• Initial Rapid Release version February 12, 2003
• Latest Rapid Release version February 12, 2003
• Initial Daily Certified version February 12, 2003
• Latest Daily Certified version February 12, 2003
• Initial Weekly Certified release date February 12, 2003

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: High

Distribution

• Distribution Level: High