W32.HLLW.Oror.D@mm is a mass-mailing worm and a variant of W32.HLLW.Oror@mm. This worm attempts to spread through email, mIRC, KaZaA, network shares, and mapped drives. It also attempts to terminate and remove various security products from the infected computer.
This threat is written in the C++ language and is compressed with UPX. The uncompressed size is about 160 KB.
Also Known As: I-Worm.Roron.4999.c [KAV], W32/Roro.V@mm [F-Prot], W32/Roron.AA@mm [RAV]
Variants: W32.HLLW.Oror@mm, W32.HLLW.Oror.B@mm, W32.HLLW.Oror.C@mm
Infection Length: 71,680 bytes
Systems Affected: Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, Windows Me
Systems Not Affected: Windows 3.x, Macintosh, OS/2, UNIX, Linux