W32.HLLW.Redist.C@mm

W32.HLLW.Redist.C@mm is a mass-mailing worm that uses Microsoft Outlook to send itself to all the contacts in the Outlook Address Book. The worm also attempts to spread itself through KaZaA, KaZaA Lite, KMD, LimeWire, Gnucleus, Shareaza, BearShare, Edonkey, Edonkey2000, Morpheus, Grokster, WinMX, Tesla, Overnet, XoloX, Rapigator file-sharing networks, and ICQ.

When W32.HLLW.Redist.C@mm runs, it displays a fake message, titled "Error Starting Program."

The email has the following characteristics:

Subject: Funny picture
Attachment: CartoonComedy.pif

Subject: The passwords
Attachment: PswdLst01.pif

Subject: The file
Attachment: Database<a random number>.pif

Subject: That file
Attachment: Soccer<a random number>.pif

Subject: Fire Screensaver
Attachment: FireScreen.scr

Subject: Stupid picture
Attachment: Armadillo.pif

Subject: Web design
Attachment: WebDesignSetup.exe

This threat is written in the Microsoft Visual Basic programming language and is compressed with UPX.

Protection

• Initial Rapid Release version July 11, 2003
• Latest Rapid Release version July 19, 2008 revision 019
• Initial Daily Certified version July 11, 2003
• Latest Daily Certified version January 20, 2009 revision 048
• Initial Weekly Certified release date July 16, 2003

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Medium

Distribution

• Distribution Level: High