1. /
  2. Security Response/
  3. W32.HLLW.Niden


Risk Level 1: Very Low

July 11, 2003
February 13, 2007 12:03:43 PM
Systems Affected:
Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP

W32.HLLW.Niden is a worm that attempts to spread itself through file-sharing networks. It also attempts to mass-mail itself to all the contacts in the Windows Address Book. However, due to bugs in the code, the mass-mailing routine does not work properly.

Furthermore, it attempts to disguise itself as Norton Anti-Virus 2003 by using the following icon:

When W32.HLLW.Niden is executed, it displays a fake error message, titled "Error Starting Application." The worm also attempts to delete files belonging to various antivirus programs.

W32.HLLW.Niden is written in the Microsoft Visual Basic (VB) programming language. The VB run-time libraries are required to execute W32.HLLW.Niden.

Antivirus Protection Dates

  • Initial Rapid Release version July 11, 2003
  • Latest Rapid Release version September 28, 2010 revision 054
  • Initial Daily Certified version July 11, 2003
  • Latest Daily Certified version September 28, 2010 revision 036
  • Initial Weekly Certified release date July 16, 2003
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment


  • Wild Level: Low
  • Number of Infections: 0 - 49
  • Number of Sites: 0 - 2
  • Geographical Distribution: Low
  • Threat Containment: Easy
  • Removal: Moderate


  • Damage Level: Medium


  • Distribution Level: Medium
Writeup By: Robert X Wang

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
Internet Security Threat Report
Symantec DeepSight Screensaver