W32.HLLW.Kickin.A@mm

W32.HLLW.Kickin.A@mm is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses that it finds in the following address books:

• .NET Messenger
• MSN Messenger
• Yahoo Pager
• Windows
• ICQ Address Books
  
  The worm also sends itself to the email addresses from the files whose extensions contain the letters ht or ml. The email message has a randomly chosen subject line, message body, and attachment filename. W32.HLLW.Kickin.A@mm spoofs the sender's email address. The attachment has the extension .com, .exe, .scr, or .pif.

The worm also attempts to spread itself through the Morpheus, Bearshare, and Edonkey2000 file-sharing networks, and through mIRC. This worm terminates some antivirus and firewall processes.

This threat is written in the Microsoft C++ programming language and is compressed with UPX.

NOTE: Virus definitions dated prior to May 8, 2003 may detect this as W32.HLLW.Cydog.C@mm.



A minor variant which displays the same functionality as the original was discovered on May 7, 2003. Detection for this variant is included in virus definitions dated May 8, 2003 and later.