1. Symantec/
  2. Security Response/
  3. W32.HLLW.Winevar


Risk Level 2: Low

November 23, 2002
February 13, 2007 11:41:16 AM
Also Known As:
W32/Korvar [McAfee], WORM_WINEVAR.A [Trend], I-Worm.Winevar [KAV]
Systems Affected:
CVE References:
CVE-2000-1061 CVE-2001-0154

W32.HLLW.Winevar is a mass-mailing worm that disables some antivirus and firewall programs and drops and executes the W32.FunLove.4099 virus.

Symantec Security Response encourages you to block email attachments that have .pif or .ceo extensions.

W32.HLLW.Winevar arrives in an email that contains three attachments. The names are variable but they will have the format:
  • Win<several characters>.Txt (12.6 KB) Music_1.htm
  • Win<several characters>.Gif (120 Bytes) Music_2.ceo
  • Win<several characters>.pif

The .htm file exploits the Microsoft VM ActiveX Component vulnerability to register the .ceo extension as an executable file. The email message is formed to take advantage of the Incorrect MIME Header Can Cause IE to Execute E-mail Attachment vulnerability, but due to a bug in the code, the attachment will not run automatically. Please note that the .htm will be detected as JS.Exception.Exploit.

Antivirus Protection Dates

  • Initial Rapid Release version November 24, 2002
  • Latest Rapid Release version September 28, 2010 revision 054
  • Initial Daily Certified version November 24, 2002
  • Latest Daily Certified version September 28, 2010 revision 036
  • Initial Weekly Certified release date November 24, 2002
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.
Writeup By: Peter Ferrie

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
2016 Internet Security Threat Report, Volume 21
  • Twitter
  • Facebook
  • LinkedIn
  • Google+
  • YouTube