W32.HLLW.Cult.H@mm

W32.HLLW.Cult.H@mm is a mass-mailing worm that uses its own SMTP engine to send itself to randomly generated recipient names at these domains:

• email.com
• Earthlink.net
• Roadrunner.com
• yahoo.com
• msn.com
• hotmail.com

The email message has the following characteristics:

Subject: I Love You ^_^ I sent you a beautiful Love Card
Message:
To see your Card, Please open the attachment

If you want to send a reply, please visit
http:/ /www.Love-card.com/Love/index.html

Thank You...
Attachment: BlueMountaineCard.pif

The worm also has IRC Trojan functionality that allows the Trojan's creator to control the infected computer by using Internet Relay Chat (IRC).

This threat is compressed with ASPack.

Protection

• Initial Rapid Release version August 22, 2003
• Latest Rapid Release version July 19, 2008 revision 019
• Initial Daily Certified version August 22, 2003
• Latest Daily Certified version January 20, 2009 revision 048
• Initial Weekly Certified release date August 27, 2003

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Low

Distribution

• Distribution Level: High