W32.HLLW.Kickin.D@mm

W32.HLLW.Kickin.D@mm is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses from the following sources:

• Windows Messenger or MSN Messenger
• Microsoft Outlook address book
• Local files for email addresses, such as those that have the extensions .mmf, .nch, .mbx, . eml, . tbb, .dbx, and .ocs.

The worm also attempts to spread by network shares, file-sharing networks, and also attempts to terminate the active processes of various antivirus, firewall, and system utility applications.

This threat is written in the Microsoft C++ programming language and is compressed with ASPACK, and is encrypted with VGCRYPT.