W32.HLLO.Videoinf

SUMMARY

W32.HLLO.Videoinf is a virus that overwrites .ht* and .exe files in the folder that it is executed from. It sends information from the computer on which it is run to an email address. On certain dates, the virus will modify the C:Autoexec.bat file so that the hard drive will be formatted when the computer is restarted.

Protection

• Virus Definitions (Intelligent Updater) July 18, 2001

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Low

Distribution

• Distribution Level: Low

TECHNICAL DETAILS

W32.HLLO.Videoinf is a virus written in a high-level language. The virus, when executed, does the following:

1. It overwrites all .ht* files (for example, .htm and .html) in the same folder as the virus with a copy of itself.
2. It extracts information from the registry and sends it to an email address. It is highly likely that this email address belongs to the author of the virus.
3. It then overwrites all *.exe files in the in the same folder as the virus with a copy of itself.
4. Next, it determines whether or not it should execute the payload routine.
5. It then displays the message:
   
   
   
   
   

Details on sent information
The information that is extracted from the registry and sent as an email message is as follows:

• Operating System
• Operating System Version
• RegisteredOwner
• RegisteredOrganisation
• ProductName
• ProductKey
• ProductID
• HostName

After the email has been sent, the virus sets a registry key so that this action is not performed more than once.

Payload
The Payload will be executed on the following dates of each month.

• 3rd
• 4th
• 10th
• 20th

The payload consists of modifying the C:Autoexec.bat file so that the C drive is formatted when you restart the computer.

Recommendations

Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":

• Turn off and remove unneeded services. By default, many operating systems install auxiliary services that are not critical, such as an FTP server, telnet, and a Web server. These services are avenues of attack. If they are removed, blended threats have less avenues of attack and you have fewer services to maintain through patch updates.
• If a blended threat exploits one or more network services, disable, or block access to, those services until a patch is applied.
• Always keep your patch levels up-to-date, especially on computers that host public services and are accessible through the firewall, such as HTTP, FTP, mail, and DNS services (for example, all Windows-based computers should have the current Service Pack installed.). Additionally, please apply any security updates that are mentioned in this writeup, in trusted Security Bulletins, or on vendor Web sites.
• Enforce a password policy. Complex passwords make it difficult to crack password files on compromised computers. This helps to prevent or limit damage when a computer is compromised.
• Configure your email server to block or remove email that contains file attachments that are commonly used to spread viruses, such as .vbs, .bat, .exe, .pif and .scr files.
• Isolate infected computers quickly to prevent further compromising your organization. Perform a forensic analysis and restore the computers using trusted media.
• Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses. Simply visiting a compromised Web site can cause infection if certain browser vulnerabilities are not patched.

REMOVAL

1. Run LiveUpdate to make sure that you have the most recent virus definitions.
2. Start Norton AntiVirus (NAV), and run a full system scan, making sure that NAV is set to scan all files.
3. Delete any files detected as W32.HLLO.Videoinf. If necessary, replace them from a clean backup.
4. If the payload has run, and you have not yet restarted the computer, follow these steps before doing so:
   
   NOTE: (For Windows Me users only) Due to the file protection process in Windows Me, there may be a backup copy of the file you are about to edit in the C:WindowsRecent folder. We recommend that you delete this file before you continue with the steps in this section. To do so using Windows Explorer, go to C:WindowsRecent, and, in the right pane, select the Autoexec.bat file and delete it. It will be regenerated as a copy of the file that you are about to edit when you save your changes to that file.

1. Click Start, and then click Run.
2. Type the following, and then click OK.
   
   edit c:autoexec.bat
   
   The MS-DOS Editor opens.
3. Remove any lines that contain the command format, such as format c:
4. Click the File menu, and then click Save.
6. Click the File menu, and then click Exit.