Press Release Summary = Virus monitoring service of Doctor Web, Ltd. informs users about epidemic propagation of new modification of the mass mailing worm labeled Win32.HLLM.Limar, also known as Email-Worm.Win32.Warezov and Win32/Stration.6wm!Worm.
Press Release Body = According to virus statistics of Doctor Web, Ltd. its presence has already reached 50-70% of mail traffic of Russian segment of Internet (RuNet) during last 24 hours.
The infected message looks as follows
The worm spreads in attachments to mail messages the subject of which can be:
* Server Report * Status * Error * Test * Mail Delivery System * Mail server report. * Mail Transaction Failed * Good day * picture * Hello
The attachment can be a ZIP-archive, an EXE-files or a file with double extension . The attachments can bear the following names:
* Update-KB[some digits]-х86 with ZIP or EXE extension. * test, body, docs, doc, test, text, readme, file, document, data.
Destructive features
The worm masquerades its processes and blocks certain anti-virus programs and firewallsв.
More detailed description of Win32.HLLM.Limar you can find here.
Additionally, Win32.HLLM.Limar propagates via ICQ instant messaging networks offering careless users to download some file.
Experts from Doctor Web, Ltd. made a special entry in the virus base allowing to detect a wide range of modifications of the family of these worms - Win32.HLLM.Limar.based.
Users of Dr.Web Anti-virus programs can feel safe as their computers are protected with SpIDerMail ® - an anti-virus mail guard, which scans all incoming mails before it is processed by the mail client.
If your computer got infected with Win32.HLLM.Limar, you can use our free curing utility Dr.Web CureIt!. Before running the utility, yu should reboot a computer in a Safe mode.
2012
