病毒名称：W32.HLLW.Oror@mm

发现日期：2002-08-27

病毒类型：蠕虫病毒

传播范围：低

危害级别：中

传播速度：低

病毒介绍：

W32.HLLW.Oror@mm是一个邮件蠕虫病毒，其将发送本身到所有的电子邮件寄件地址，通过它向外大量传播病毒。此病毒也能够覆盖mIRC脚本文件。它还能通过网络共享文件夹进行传播，并且使被感染的机器所正在执行的文件窗口无法打开，更重要的是它能够删除反病毒和防火墙程序。此病毒感染安装有Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, Windows Me 操作系统的计算机，而不会感染安装有 Macintosh, Unix, Linux 操作系统的计算机。

1.此病毒发送的电子邮件题目可能是下列各项中的一个：

Zdrasti..

Ohoo!!

Pisamce

Liubofta e kato Rai, no moje da boli kato Ad

TinKi WinKy!!

HeY :)

ZzZz :)

Vajno!!

Blondinkii:)

Hi BaBy :)

HeY..

aBcDeFgHiJkLmNoPqRsT..

Don't cry

Very Important

Miracle

LOVE is like HEAVEN but it can hurt like HELL.

Blondies Forever :)

Hi!!

WoWoWoWOWowo..

yoOo ;)

此病毒发送的电子邮件附件可能是下列各项中的一个：

Love Zodiak.exe

TNT!CC gEN.exe

Panda Anti-Worm.exe

Blondies.exe

mTV Charts.exe

Setup.exe

Osama Your Mamma.exe

[TNT]!CC geN.exe

Sorry.exe

Magic.exe

Love.exe

Zodiak.exe

mTV.exe

Faith.exe

Kama Sutra.exe

Fun.exe

Smile.exe

Pamela.exe

Candy.exe

2.此网络蠕虫病毒程序一旦被激活并开始运行，它将显示如下假信息：

3.它能够复制本身到系统文件夹并生成一个新文件(在原文件后加上2k,16,32)，如：

C:\\%windir%\\Rundll16.exe

此时，它还能够产生键值(LoadCurrentProfile Rundll16.exe powprof.dll, LoadCurrentUserProfile)到注册表编辑器:

HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run中，使得机器在一启动时自动运行病毒程序。

4.它还能够查找系统子文件夹C:\\Program Files\\Internet Explorer，并产生一个新文件（在原文件加上2k,16,32）,如：

C:\\Program Files\\Internet Explorer\\Internet Explorer2k.exe

同时，它产生键值（Internet Explorer C:\\Program Files\\Internet explorer\\Internet

Explorer2K.exe）到注册表编辑器:

HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run中，使得机器在一启动时自动运行病毒程序。

5.此蠕虫病毒发送它本身到全部的电子邮件地址，并利用它自己的SMTP引擎和默认的电子邮件程序扩展它自己，它发送的电子邮件包含下列信息：

(1)题目：Zdrasti..

内容：

Hey, kak , ujas mi e toplo daji smqtam ei sq da si farlq edin dush che ne sa disha :) Skoro shti pratq onva det obeshtah, za sq mojesh da hvarlish edno oko na %s

(2)题目：Ohoo!!

内容：

Yoo, kak e havata, v momenta se 4ustvam mnoo qko i reshih da pisha na priqtelite :) nabarah edin mnoo zdrav site, %s - Cool a? Aide chakam otgovor :)

(3)题目：Pisamce

内容：

Neska mi se slu4iha kup neshta :) Oshte ot sutrinta adski mi varvi, shte vzema da pusna edin fish ~~P V takova dobro nastroenie sam 4e reshih da vi pisha. Pri teb kak e, Neshto novo ima li? Osven vsi4ko ti pratih i iznenadka, sled kato q instalirash si vij shti sa poqvi mnoo qka madama v Tray-a :) I naposledak poshtata mi stoi tajno prazna tai che ... :)) Doskoro

(4)题目：TinKi WinKy!!

内容：

Zdrasti, trqq da proveda edin razgovor s dosta hora, ama shi vidim koga sha stane tova, naistina imam da kazvam mnogo neshta .. Ako imash i ti neshto da mi kazvash, ne se kolebai, a napishi edno pisamce. Vqrvai v me4tite si i gledai napred :))

P.S. Pogledni attachmenta i vij dali shti dopadne :)) Kefi li te? Az mnoo mu sa radvah ;)) Bye

(5)题目：HeY :)

内容：

Tiriritam tiriram :)) zDraVeI, neshto novo?? :) Kak varvi lqtoto? Plaj, basein, kuponi :) Beshe mi skuchno i si vikam shto da ne napisha nqkoi drugo pismo :> Kakvoto i da stava da jivee lqtoto i nie pokrai nego ~~~PpPpPp. Vij iznendkata ~pP Aide i chakam..

(6)题目：HeY..

内容：

HeY.. Buddz what'z up :) How are you? I'm fine, 10x!! My friend Nina is here and we are.. You know :) Lalala !! I've just wanted to tell you. Btw check this site - %s, it's kewl :)) Cya

(7)题目：aBcDeFgHiJkLmNoPqRsT..

内容：

Hi, Don't forget about MAL"F" :) And don't tell anybody :Ppp have you seen this site? It's very interesting!! :) %s .. Leave this away, how are you? Send me sth cool, plzz :) bye! :)

(8)题目：Miracle

内容：

All I need is a miracle, all i need is love.. YeS. That's true i love you my friends :) If you are wondering why I am so happy - i'll tell you - I am enga.. oOps, later..Bye and uhh unzip the attachment. It's the best joke, i've ever seen. Bye, see ya :)

上述各题目的附件有可能是下列的一个：

Magic.exe

Love.exe

Zodiak.exe

mTV.exe

Faith.exe

Kama Sutra.exe

Fun.exe

Smile.exe

Pamela.exe

Candy.exe

而这个病毒也可能同时产生下列题目和附件：

(9)题目：Liubofta e kato Rai, no moje da boli kato Ad

内容：

Zdr, izpratih na vsichki edna programka, mnoo qka, btw to imeto si pokazva. Subject-a e ot tam i ima i drugi mnogo qki misli. Moje da pokaje nai-podhodqshtiq partnior v liubofta :)) Ujasno e kak liubofta moje da ubie vsichko v teb.. Za shtastie ne vinagi e taka :) Bye !!

附件：Love Zodiak.exe

(10)题目：ZzZz :)

内容：

Zdrasti, kak q karash :) az sam dobre, makar che naposledak imam malko problemi. Tvarde mnogo mi se strupa navednaj, mai i rakata mi e s4upena.. Kvo da se pravi, takav e jivota.. Vchera namerih nqkav generator na kreditni karti i mai bachka, samo edin go probvah ama stana, vij dali pri teb sha raboti i umnata :) I ne zabravqi che "Liuboftaa e po cennaa ot vsi4ko" :)) Chao ti

附件：TNT!CC gEN.exe

(11)题目：Vajno!!

内容：

Ima nov opasen virus v neta! Razprostranqva se predimno po IRC i ICQ. Vnimavai da ne se zarazish, zashtoto iztriva Mp3-ki, Filmi i Dokumenti. Izpratih ti patch, koqto shte te zashtiti ot zarazqvane. Iskah da napisha po-dulgo pismo, no nqmah vreme, sorka :( Naposledak imam adski mnogo rabota nalqvo nadqsno :)) Inache kak varvi? Aide doskoro i watch out :)))

附件：Panda Anti-Worm.exe

(12)题目：Blondinkii:)

内容：

Namerih edna mnoo qka programka i neznam zashto, no mi napomni za teb :)

Kakvo pravi blondinka kato rodi bliznaci? - Chudi se koi e vtoriq tatko :)

Kakva e razlikata mejdu 10 ovce i 3 blondinki? Otgovor: 7

Kak mojesh da razsmeesh blondinka v petak? - Kato i razkajesh vic vav vtornik :)

Zdrasti! kak si :) Kefqt li ta vicovete? Shegichka de :) Pratih ti q. Razkazva ti qki vicove za blondinki na 5 minuti :) Posmqh se za baq vreme napred :))) Bye, doskoro, i po chesto v chata, chao :}

附件：Blondies.exe

(13)题目：Hi BaBy :)

内容：

Hi baby, kak e :) ko si praikash? az si slusham muzichka - ATC i Mortal Kombat Soundtrack -

Varhovni sa, napravo izbuhnah :))) Drapnah si gi ot neta s taq programka - ima 200

kubriliona klasacii :) Naposledak muzikata e edno ot malkoto mi udovolstviq

P.S. Obezatelno si drapni ATC - Why oh why.mp3 :))

Chao, doskoro!!

附件：mTV Charts.exe

(14)题目： Don't cry

内容：

It won't be easy, you think it's strange, when I try to explain how i feel and I still want your love after all I have done. You won't believe me.. I had to let it happen, i had to change.. Hey, just kiddin' :) Madonna - "Don't cry" I've just wanted to .. Infact I don't know nothing i don't want to know anything :))) Do you like the funny program :) I'm waiting for the reply :>> Bye

附件：(Candy.exe)

(15)题目：Very Important

内容：

There is a very dangerous virus circulating in the net. It's called RoRo and it's using IRC to infect computers. This virus deletes movies, music and corrupt your windows installation. To prevent from infecting, install McAfee Anti-Script 2002. It's a 30-days demo.. So, how are you? Good, Bad? I'm oK. I wanted to write you a longer letter, but i didn't have enough time.. sorry. Bye

附件： Setup.exe

(16)题目：LOVE is like HEAVEN but it can hurt like HELL.

内容：

I've just found this program, and, I don't know why... but it reminded me of you. I read this there. There are cool ideas, especially about lOvE. i like it, but let's talk about you? Are you oK? Are you in love :))) I'm waiting for the replyyy :)) bye ~pPpP

附件： Love Zodiak.exe

(17)题目：Blondies Forever :)

内容：

Hiya :) I've just wannted to send you these jokes

- What do blondes wear behind their ears to attract men? Their ankles!!

- Why did god invent the female orgasm? So blondes know when to stop screwing!!

- What's the difference between a blonde and aeroplane? Not everyone's been in a aeroplane!

- What is a blond with hair black colored? Artificial intelligence!

附件： Blondies.exe

(18)题目：Hi!!

内容：

Hi baby :)) Whatz Uppp :)) I'm feelin extra power cause i got high in the sky :) sMiLe

:oP~pPPPpp Where are you? What are you doing? I send you a c00l flAsh :) See you soon :)) Bye Bye

附件： Osama Your Mamma.exe

(19)题目：WoWoWoWOWowo..

内容：

Hi again.. You can't guess what i've found.. Finally i've found a working Credit Card

generator!! I'm the richest man in the net :)) Don't tell or send it to anybody! How are you? What're you doing?Bye..

附件： Sorry.exe

(20)题目：yoOo ;)

内容：

YoOo :)) What a nice day, what a nice time :) What a nice world :)) Do you have any ATC's mp3z? eXtreemly cool :) I've found them with this program, it's like Napster, but it's legal :))

P.S. Download ATC - Why oh why.mp3 !!! Bye ~~~~ppPpP ;)

附件： mTV Charts.exe

6.此蠕虫病毒复制到网络共享文件夹会产生下列各项文件：

Kama Sutra.exe

GiRlZ FoReVeR (Wow).exe

Nikita v1.1 (Zip).exe

Pamela Anderson (Porno Installation).exe

Britney Spears Naked.exe

Teen Sex Cam.exe

Kurnikova Screensaver (6+).exe

CrEdIt CaRdZ gEn.exe

SeX.eXe

Faith.exe

解决方案：

1.及时升级杀毒软件，之后认真在整个硬盘上查杀此病毒，彻底清除掉查到的W32.HLLW.Oror@mm蠕虫病毒。

2. 到注册表编辑器:

HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run中将键值：

LoadCurrentProfile Rundll16.exe powprof.dll,LoadCurrentUserProfile和Internet Explorer C:\\Program Files\\Internet explorer\\Internet Explorer2K.exe清除。