Current Virus Warnings
Epidemic of new modification of Win32. HLLM.Limar
October 19, 2006
Virus monitoring service of Doctor Web, Ltd. informs users about epidemic propagation of new modification of the mass mailing worm labeled Win32.HLLM.Limar, also known as Email-Worm.Win32.Warezov and Win32/Stration.6wm!Worm.
According to virus statistics of Doctor Web, Ltd. its presence has already
reached 50-70% of mail traffic of Russian segment of Internet (RuNet)
during last 24 hours.
The infected message looks as follows
The worm spreads in attachments to mail messages the subject of which can be:
Server Report
Status
Error
Test
Mail Delivery System
Mail server report.
Mail Transaction Failed
Good day
picture
Hello
The attachment can be a ZIP-archive, an EXE-files or a file with double
extension .
The attachments can bear the following names:
Update-KB[some digits]-х86 with ZIP or EXE extension.
test, body, docs, doc, test, text, readme, file, document, data.
Destructive features
The worm masquerades its processes and blocks certain anti-virus programs and firewalls.
More detailed description of Win32.HLLM.Limar you can find here.
Additionally, Win32.HLLM.Limar propagates via ICQ instant messaging
networks offering careless users to download some file.
Experts from Doctor Web, Ltd. made a special entry in the virus base
allowing to detect a wide range of modifications of the family of these
worms - Win32.HLLM.Limar.based.
Users of Dr.Web Anti-virus programs can feel safe as their computers are protected with SpIDerMail ® - an anti-virus mail guard, which scans all incoming mails before it is processed by the mail client.
If your computer got infected with Win32.HLLM.Limar, you can use our free curing utility Dr.Web CureIt!. Before running the utility, you should
reboot a computer in a Safe mode.
Doctor Web, Ltd.
http://www.drweb.com
20.10.2006 Dr.Web Online:
Following mailtext seems to be typical for this virus mails:
- Our firewall determined the e-mails containing worm copies are being sent from your computer
- The message contains Unicode characters and has been sent
- Mail transaction failed. Partial message is available
- The message cannot be represented in 7-bit ASCII encoding
Login
Deutsch
