*Heads Up* Hawawi & Der

Another Two you may encounter..


Symantec info

Quote:

---

W32.Hawawi.Worm
W32.Hawawi.Worm is a worm that spreads through email using its own SMTP server, ICQ, Yahoo Messenger, PalTalk, and KaZaA. The email message has one of many different Subject lines, such as:
'''*< Love Speaks it all >*'''
Co0o0o0o0oL
Fw:
Heeeeeeeeeeeeeeeey
Wussaaaaaaaap?
WoW But not for NoW
Why Do We FOk?

The messages have an attachment with a .pif extension, usually Hawawi.pif.

W32.Hawawi.Worm has a payload of overwriting all the files that have the following extensions, with zero-byte files:
mpeg
rm
wav
sql
mde
php
cpp
swf
ram
mp3
frm
dpr
rar
mpg
jpg
pdf
pps
ppt
txt
htm
html
zip
doc
mdb
xls


Also Known As <http://securityresponse.symantec.com/avcenter/refa.html>: W32/Holar.d@MM [McAfee]
Type: Worm <http://securityresponse.symantec.com/avcenter/refa.html>
Infection Length <http://securityresponse.symantec.com/avcenter/refa.html>: 25,776 bytes, 58,185 bytes, 1,185 bytes, 14,336 bytes, 10,258 bytes
Systems Affected <http://securityresponse.symantec.com/avcenter/refa.html>: Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, Windows Me
Systems Not Affected <http://securityresponse.symantec.com/avcenter/refa.html>: Macintosh, OS/2, UNIX, Linux

---

Symantec info

Quote:

---

W32.HLLW.Der@mm

W32.HLLW.Der@mm is a mass mailing worm that attempts to use Microsoft Outlook to email itself to all the contacts in the Windows Address Book. It also attempts to overwrite and delete numerous files on the infected system.
The email has the following characteristics:

Subject: <Recipients.name>, WORLD TRADE CENTER PICTURES
Message: <Recipients.name>, Remember The Times.......MAYBE THEY WILL BE BACK....!!!
Attachment: WTC32.scr

This threat is written in Microsoft Visual Basic (VB). The VB run-time libraries must be installed for the worm to execute.

NOTE: Virus definitions dated prior to March 19, 2003 may detect this threat as Bloodhound.W32.VBWORM.


Type: Worm <http://securityresponse.symantec.com/avcenter/refa.html>
Infection Length <http://securityresponse.symantec.com/avcenter/refa.html>: 61,440 bytes
Systems Affected <http://securityresponse.symantec.com/avcenter/refa.html>: Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, Windows Me
Systems Not Affected <http://securityresponse.symantec.com/avcenter/refa.html>: Windows 3.x, Macintosh, OS/2, UNIX, Linux

---

Cheers