W32.Hawawi.Worm is a worm that spreads through email using its own SMTP server, ICQ, Yahoo Messenger, PalTalk, and KaZaA. The email message has one of many different Subject lines, such as:
- '''*< Love Speaks it all >*'''
- WoW But not for NoW
- Why Do We FOk?
The messages have an attachment with a .pif extension, usually Hawawi.pif or Hawa.pif.
W32.Hawawi.Worm has a payload of overwriting all the files that have the following extensions, with zero-byte files:
A minor variant of W32.Hawawi.Worm was discovered on May 28, 2003. Detection for this was incorporated into the May 29, 2003 virus definitions.
Click for a more detailed description of Rapid Release and Daily Certified virus definitions.