W32.HLLW.Franriv

Risk Level 1: Very Low

Printer Friendly Page

Discovered: October 29, 2003

Updated: February 13, 2007 12:12:56 PM

Also Known As: WORM_FRANRIV.A [Trend]

Systems Affected: Windows 2000, Windows 3.x, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

When W32.HLLW.Franriv runs, it performs the following actions:

Attempts to copy itself as C:\Windows\microsoftscanreg.exe.

Note: Due to bugs in the code, the file does not copy itself as intended.
Creates the subdirectory C:\Windows\scanregfile\kazaa\My Shared Folder, if C:\Windows exists.
Adds the value:

"Microsoft Scanreg" = "C:\Windows\microsoftscanreg.exe"

to the registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
If the key:

HKEY_CURRENT_USER\Software\Kazaa\LocalContent

does not exist, the worm will create it.
Modifies the value:

"DownloadDir" = "C:\Windows\Scanregfile\Kazaa\My Shared Folder"

in the registry key:

HKEY_CURRENT_USER\Software\Kazaa\LocalContent
May play a MIDI tune and display one of the following windows:
Attempts to copy itself into the folder, C:\Windows\Scanregfile\kazaa\My Shared Folder, as a series of zero-byte files with the following file names:
- Age Of Mythology FR CRACK.exe
- Alcatraz Fr Crack.exe
- Allopass + audiotel Keygen 2003.exe
- Arx Fatalis FR CRACK.exe
- Battlefield 1942 FR Crack.exe
- Clone CD 5 keygen.exe
- Delphi 5 fr crack keygen.exe
- Delphi 6 fr crack keygen.exe
- Delphi 7 fr crack keygen.exe
- Dreamweaver MX keygen + crack by orran.exe
- Fire-Works MX keygen + crack by orran.exe
- Flash MX keygen + crack by orran.exe
- Madden NFL 2003 FR CRACK.exe
- Mafia Fr Nocd.exe
- Medieval Total War Fr Crack.exe
- Mega-Serial Microsoft Macromedia Borland Photoshop.exe
- Nero FR 5.6 keygen + crack.exe
- No One Lives Forever 2 FR CRACK.exe
- Office XP fr Activation crack keygen.exe
- Photoshop FR 7 keygen + crack by orran.exe
- Sim City 4 FR Crack by zorio.exeUnreal 2003 Fr Nocd.exe
- Visual Basic fr 6.00 crack keygen.exe
- Visual fr c++ crack keygen.exe
- Visual.net fr Activation keygen crack.exe
- Winace fr 4 keygen crack.exe
- Windows XP Activation fr home Pro keygen 2003.exe
- Windows XP fr home et pro SP1 crack.exe
- Winrar fr 3.X keygen.exe
- Winzip fr 8.X keygen crack.exe

Writeup By: Fergal Ladley

Removal

Summary

Search Threats

Search by name

_{Example: W32.Beagle.AG@mm}