W32.HLLW.Heffer

SUMMARY

W32.HLLW.Heffer may use Microsoft Outlook to mass-mail itself to all contacts in the Outlook Address Book. It may also spread itself through the mIRC or KaZaA file-sharing network. The email has the following characteristics,

Subject: Re: <recipient  email address>
Message: Check this stuff.
Attachment: setup.exe

Several variants of W32.HLLW.Heffer have been found. All variants infect Microsoft Word documents. The infected Word documents are detected as W97M.Heffer.

This threat is written in the Microsoft Visual Basic programming language.

Protection

• Virus Definitions (LiveUpdate™ Weekly) November 21, 2002
• Virus Definitions (Intelligent Updater) November 20, 2002

TECHNICAL DETAILS

When W32.HLLW.Heffer runs, it does the following:

Depending on the variant, it may display this message:



It may copy itself as:

• C:<Microsoft Office startup folder>Efv_b.exe
• C:\%windir%Efv.exe
• C:\%windir%Install.exe

For example, it may copy itself as C:Program FilesMicrosoft OfficeOfficeStartupEfv_b.exe

NOTE: %windir% is a variable. The worm locates the Windows installation folder (by default this is C:Windows or C:Winnt) and copies itself to that location.

It may create the hidden folder C:Efv and create the following files in this folder:

• Setup.exe, which is a copy of the worm.
• Mirc_scripter.exe, which is a copy of the worm.
• Mirc_scripter.zip, which is a zipped copy of the worm.
• Worm.efv, which is a script file that is used to mass-mail the worm.
• Worm.vbs, which is a script file that is used to run the worm.efv file.

It uses C:Program FilesWinZipWinzip32.exe to compress itself as C:\%windir%Efv.zip, if Winzip32.exe exists.
It uses C:Program FilesWinRARWinRar.exe to compress itself as C:\%windir%efv.rar, if Winrar.exe exists

Depending on the variant, it may modify the (Default) value to

(Default) C:\%Windir%efv.exe %1 %*"

in the registry key

HKEY_LOCAL_MACHINESoftwareCLASSESexefileshellopencommand

The worm may create a hidden system file C:\%windir%Efv_b.reg to add the values

AVPCC
EFV_B regedit /s c:windowsefv_b.reg
NAV Agent
Norton Auto-Protect
Norton eMail Protect
TrueVector

to the registry key

HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun

and may add the value

ScriptBlocking

to the registry key

HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunServices

It terminates the following processes if they are running in the infected system,

• ZONEALARM.exe
• ESAFE.exe
• CFIADMIN.exe
• CFIAUDIT.exe
• CFINET32.exe
• PCFWallICON.exe
• FRW.exe
• VSHWIN32.exe
• NAVW32.exe
• _AVP32.EXE
• _AVPCC.EXE
• _AVPM.EXE
• AVP32.exe
• AVPCC.exe
• AVPM.exe
• AVP.exe
• LOCKDOWN2000.exe
• ICLOAD95.exe
• ICMON.exe
• ICSUPP95.exe
• ICLOADNT.exe
• ICSUPPNT.exe
• SAFEWEB.exe
• PCCWin98.exe
• NavLu32.exe
• navapw32.exe
• Nvc95.exe
• Nupgrade.exe
• FP-Win.exe
• f-stopw.exe
• scan32.exe
• avp32.exe
• poproxy.exe
• VSECOMR.exe
• WEBSCANX.exe
• AVCONSOL.exe
• VSSTAT.exe

How it spreads

If mIRC is installed in the system, the worm creates the files:

• Script.ini
• Mirc.ini
• Efv.efv

in one of these folders:

• C:Mirc
• C:Mirc32
• C:Program FilesMirc

It may also create the hidden subfolder Efv in C:Mirc, C:Mirc32 or C:Program FilesMirc, and zip itself as Mirc_scripter.zip in this hidden subfolder.

By using the script files Mirc.ini or Script.ini, the worm sends itself to other mIRC users who connect to the same mIRC channel as the infected computer.

If KaZaA is installed in the infected system, the worm may create the hidden subfolder Efv in the C:Program FilesKaZaA folder and copy itself as:

• Game cracker(all EA games !!!).exe
• Windows XP key generator.exe
• Office XP crack.exe
• Sex_Pic_server_screen.EXE
• Norton antivirus crack.exe
• KaZaA spyware remover.exe
• Winzip v8.2 + crack.exe
• KaZaA media desktop v2_0.exe
• GTA3 crack.exe
• windows_me_setup_crack.exe
• Hack IIS server.exe
• Winrar + crack.exe
• Eminem show.exe
• Bush fight sadam(new).exe
• Full Games downloader.exe

It then adds the values

Dir0 012345:c:Program FilesKaZaAefv
DisableSharing 00000000

to the registry key

HKEY_CURRENT_USERSoftwareKazaaLocalContent

so that other KaZaA users may download the worm from C:Program FilesKaZaAEfv folder.

The worm may use Microsoft Outlook to mass-mail itself to all contacts in Outlook Address Book. It may also spread itself through the mIRC or KaZaA file-sharing network. The email has the following characteristics,

Subject: Re: <recipient  email address>
Message: Check this stuff.
Attachment: setup.exe

The worm inserts a viral module into the Microsoft Word global template, Normal.dot. When you open a Word document, a text file is dropped as C:Efv.dat. This text file is the source code of the viral module and will be deleted after the open Word document has been infected.

NOTE: The infected Word documents are detected as W97M.Heffer.

This macro virus attempts to lower the Word macro security level to "Low," which will enable all macros to be executed automatically upon Word startup. It does this by modifying the value in the registry key

HKEY_CURRENT_USERSoftwareMicrosoftOffice<Office Version>WordSecurity

to

AccessVBOM 1
Level 1

Depending on the variant, if the current day is the 29th of any month, the macro virus may display the following:



It may copy itself as,

• C:<Microsoft Office startup folder>efv_b.exe
• C:\%Windir%efv.exe
• C:\%Windir%install.Exe

For example, it may copy itself as C:Program FilesMicrosoft officeofficestartupefv_b.exe

NOTE: %Windir% is a variable. The worm locates the Windows installation folder (by default this is C:Windows or C:Winnt) and copies itself to that location.

It may create a hidden folder C:efv and create the following files in this folder,

• setup.exe, which is a copy of the worm.
• mirc_scripter.exe, which is a copy of the worm.
• mirc_scripter.zip, which is a zipped copy of the worm.
• worm.efv, which is a script file to mass-mail the worm.
• worm.vbs, which is a script file to run worm.efv file.

It uses C:Program FilesWinZipwinzip32.exe to compress itself as C:\%Windir%efv.zip, if winzip32.exe exists.
It uses C:Program FilesWinRARWinRar.exe to compress itself as C:\%Windir%efv.rar, if winrar.exe exists

Deponding on the variant, it may modify the Default value to

(Default) C:\%Windir%efv.exe %1 %*"

in the registry key

HKEY_LOCAL_MACHINESoftwareCLASSESexefileshellopencommand

The worm may create a hidden system attribute file C:\%Windir%efv_b.reg to add the values

AVPCC
EFV_B regedit /s c:windowsefv_b.reg
NAV Agent
Norton Auto-Protect
Norton eMail Protect
TrueVector

in the registry key

HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun

and may add the value

ScriptBlocking

in the registry key

HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunServices


It terminates the following processes if they are running in the infected system:

• ZONEALARM.exe
• ESAFE.exe
• CFIADMIN.exe
• CFIAUDIT.exe
• CFINET32.exe
• PCFWallICON.exe
• FRW.exe
• VSHWIN32.exe
• NAVW32.exe
• _AVP32.EXE
• _AVPCC.EXE
• _AVPM.EXE
• AVP32.exe
• AVPCC.exe
• AVPM.exe
• AVP.exe
• LOCKDOWN2000.exe
• ICLOAD95.exe
• ICMON.exe
• ICSUPP95.exe
• ICLOADNT.exe
• ICSUPPNT.exe
• SAFEWEB.exe
• PCCWin98.exe
• NavLu32.exe
• navapw32.exe
• Nvc95.exe
• Nupgrade.exe
• FP-Win.exe
• f-stopw.exe
• scan32.exe
• avp32.exe
• poproxy.exe
• VSECOMR.exe
• WEBSCANX.exe
• AVCONSOL.exe
• VSSTAT.exe

How to Spread

If mIRC is installed in the system, the worm creates the files:

• script.ini
• mirc.ini
• efv.efv

into one of the following folders:

• C:mirc
• C:mirc32
• C:Program filesmirc

It may also create a hidden subfolder efv in C:mirc, C:mirc32 or C:Program filesmirc and zip itself as mirc_scripter.zip in this hidden subfolder.

By using the script files mirc.ini or script.ini, the worm sends itself to other mIRC users who connect to the same mIRC channel as the infected computer.

If KaZaA is installed in the infected system, the worm may create a hidden subfolder efv in the C:Program FilesKaZaA folder and copy itself as the following:

• game cracker(all EA games !!!).exe
• Windows XP key generator.exe
• Office XP crack.exe
• Sex_Pic_server_screen.EXE
• Norton antivirus crack.exe
• KaZaA spyware remover.exe
• Winzip v8.2 + crack.exe
• KaZaA media desktop v2_0.exe
• GTA3 crack.exe
• windows_me_setup_crack.exe
• Hack IIS server.exe
• Winrar + crack.exe
• Eminem show.exe
• bush fight sadam(new).exe
• Full Games downloader.exe

It then adds values

Dir0 012345:c:Program FilesKaZaAefv
DisableSharing 00000000

in the registry key

HKEY_CURRENT_USERSoftwareKazaaLocalContent

so that other KaZaA users may download file worm from c:Program FilesKaZaAefv folder.

The worm may use Microsoft Outlook to mass-mail itself to all contacts in Outlook Address Book. It may also spread itself throught mIRC or KaZaA file-sharing network. The email has the following characteristics:

Subject: Re: <recepient  email address>
Message: Check this stuff.
Attachment: setup.exe

The worm inserts a viral module into the Microsoft Word global template, Normal.dot. When you open a Word document, a text file is dropped as C:EFV.DAT. This text file is the source code of the viral module and will be deleted after the open Word document has been infected.

NOTE: The infected Word documents are detected as W97M.Heffer.

This macro virus attempts to lower the Word macro security level to "Low," which will enable all macros to be executed automatically upon Word start-up by modifying the value in the registry key:

HKEY_CURRENT_USERSoftwareMicrosoftOffice<Office Version>WordSecurity

to the following:

AccessVBOM 1
Level 1

If the current system date is 29, the macro virus may display the following, depending on the variant:



It may copy itself as,

• C:<Microsoft Office startup folder>efv_b.exe
• C:\%Windir%efv.exe
• C:\%Windir%install.Exe

For example, it may copy itself as C:Program FilesMicrosoft officeofficestartupefv_b.exe

NOTE: %Windir% is a variable. The worm locates the Windows installation folder (by default this is C:Windows or C:Winnt) and copies itself to that location.

It may create a hidden folder C:efv and create the following files in this folder,

• setup.exe, which is a copy of the worm.
• mirc_scripter.exe, which is a copy of the worm.
• mirc_scripter.zip, which is a zipped copy of the worm.
• worm.efv, which is a script file to mass-mail the worm.
• worm.vbs, which is a script file to run worm.efv file.

It uses C:Program FilesWinZipwinzip32.exe to compress itself as C:\%Windir%efv.zip, if winzip32.exe exists.
It uses C:Program FilesWinRARWinRar.exe to compress itself as C:\%Windir%efv.rar, if winrar.exe exists

Deponding on the variant, it may modify the Default value to

(Default) C:\%Windir%efv.exe %1 %*"

in the registry key

HKEY_LOCAL_MACHINESoftwareCLASSESexefileshellopencommand

The worm may create a hidden system attribute file C:\%Windir%efv_b.reg to add the values

AVPCC
EFV_B regedit /s c:windowsefv_b.reg
NAV Agent
Norton Auto-Protect
Norton eMail Protect
TrueVector

in the registry key

HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun

and may add value

ScriptBlocking

in the registry key

HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunServices


It terminates the following processes if they are running in the infected system,

• ZONEALARM.exe
• ESAFE.exe
• CFIADMIN.exe
• CFIAUDIT.exe
• CFINET32.exe
• PCFWallICON.exe
• FRW.exe
• VSHWIN32.exe
• NAVW32.exe
• _AVP32.EXE
• _AVPCC.EXE
• _AVPM.EXE
• AVP32.exe
• AVPCC.exe
• AVPM.exe
• AVP.exe
• LOCKDOWN2000.exe
• ICLOAD95.exe
• ICMON.exe
• ICSUPP95.exe
• ICLOADNT.exe
• ICSUPPNT.exe
• SAFEWEB.exe
• PCCWin98.exe
• NavLu32.exe
• navapw32.exe
• Nvc95.exe
• Nupgrade.exe
• FP-Win.exe
• f-stopw.exe
• scan32.exe
• avp32.exe
• poproxy.exe
• VSECOMR.exe
• WEBSCANX.exe
• AVCONSOL.exe
• VSSTAT.exe

How to Spread

If mIRC is installed in the system, the worm creates the files

• script.ini
• mirc.ini
• efv.efv

into one of the following folders,

• C:mirc
• C:mirc32
• C:Program filesmirc

It may also create a hidden subfolder efv in C:mirc, C:mirc32 or C:Program filesmirc, and zip itself as mirc_scripter.zip in this hidden subfolder.

By using the script files mirc.ini or script.ini, the worm sends itself to other mIRC users who connect to the same mIRC channel as the infected machine.

If KaZaA is installed in the infected system, the worm may create the a hidden subfolder efv in the C:Program FilesKaZaA folder and copy itself as the following,

• game cracker(all EA games !!!).exe
• Windows XP key generator.exe
• Office XP crack.exe
• Sex_Pic_server_screen.EXE
• Norton antivirus crack.exe
• KaZaA spyware remover.exe
• Winzip v8.2 + crack.exe
• KaZaA media desktop v2_0.exe
• GTA3 crack.exe
• windows_me_setup_crack.exe
• Hack IIS server.exe
• Winrar + crack.exe
• Eminem show.exe
• bush fight sadam(new).exe
• Full Games downloader.exe

It then adds values

Dir0 012345:c:Program FilesKaZaAefv
DisableSharing 00000000

in the registry key

HKEY_CURRENT_USERSoftwareKazaaLocalContent

so that other KaZaA users may download file worm from c:Program FilesKaZaAefv folder.

The worm may use Microsoft Outlook to mass-mail itself to all contacts in Outlook Address Book. It may also spread itself throught mIRC or KaZaA file-sharing network. The email has the following characteristics,

Subject: Re: <recepient  email address>
Message: Check this stuff.
Attachment: setup.exe

The worm inserts a viral module into the Microsoft Word global template, Normal.dot. When you open a Word document, a text file is dropped as C:EFV.DAT. This text file is the source code of the viral module and will be deleted after the open Word document has been infected.

NOTE: The infected Word documents are detected as W97M.Heffer.

This macro virus attempts to lower the Word macro security level to "Low" which will enable all macros to be executed automatically upon Word start-up by modifying the value in the registry key

HKEY_CURRENT_USERSoftwareMicrosoftOffice<Office Version>WordSecurity

to the following,

AccessVBOM 1
Level 1

If the current system date is 29, the macro virus may display the following, deponding on the variant,

Recommendations

Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":

• Turn off and remove unneeded services. By default, many operating systems install auxiliary services that are not critical, such as an FTP server, telnet, and a Web server. These services are avenues of attack. If they are removed, blended threats have less avenues of attack and you have fewer services to maintain through patch updates.
• If a blended threat exploits one or more network services, disable, or block access to, those services until a patch is applied.
• Always keep your patch levels up-to-date, especially on computers that host public services and are accessible through the firewall, such as HTTP, FTP, mail, and DNS services (for example, all Windows-based computers should have the current Service Pack installed.). Additionally, please apply any security updates that are mentioned in this writeup, in trusted Security Bulletins, or on vendor Web sites.
• Enforce a password policy. Complex passwords make it difficult to crack password files on compromised computers. This helps to prevent or limit damage when a computer is compromised.
• Configure your email server to block or remove email that contains file attachments that are commonly used to spread viruses, such as .vbs, .bat, .exe, .pif and .scr files.
• Isolate infected computers quickly to prevent further compromising your organization. Perform a forensic analysis and restore the computers using trusted media.
• Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses. Simply visiting a compromised Web site can cause infection if certain browser vulnerabilities are not patched.

REMOVAL

NOTE: These instructions are for all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

1. Update the virus definitions.
2. Restart the computer in Safe Mode.
3. Copy the file Regedit.exe to Regedit.com.
4. Edit the registry and reverse the changes that were made by the worm.
5. Run a full system scan and delete all files that are detected as W32.HLLW.Heffer or W97M.Heffer.

For details on how to do this, read the following instructions.

To update the virus definitions:
All virus definitions receive full quality assurance testing by Symantec Security Response before being posted to our servers. There are two ways to obtain the most recent virus definitions:

• Run LiveUpdate, which is the easiest way to obtain virus definitions. These virus definitions are posted to the LiveUpdate servers once each week (usually Wednesdays) unless there is a major virus outbreak. To determine whether definitions for this threat are available by LiveUpdate, look at the Virus Definitions (LiveUpdate) line at the top of this write-up.
• Download the definitions using the Intelligent Updater. Intelligent Updater virus definitions are posted on U.S. business days (Monday through Friday). They must be downloaded from the Symantec Security Response Web site and installed manually. To determine whether definitions for this threat are available by the Intelligent Updater, look at the Virus Definitions (Intelligent Updater) line at the top of this write-up.
  
  Intelligent Updater virus definitions are available here. For detailed instructions on how to download and install the Intelligent Updater virus definitions from the Symantec Security Response Web site, click here.

To restart the computer in Safe mode:
All Windows 32-bit operating systems, except Windows NT, can be restarted in Safe mode. For instructions on how to do this, read the document How to start the computer in Safe Mode.

To copy Regedit.exe to Regedit.com:
Because the worm may modify the registry so that you cannot run .exe files, you must first make a copy of the Registry Editor as a file with the .com extension, and then run that file.

1. Do one of the following, depending on which operating system you are running:
   • Windows 95/98 users: Click Start, point to Programs, and click MS-DOS Prompt. This opens a DOS window at the C:Windows prompt. Go on to step 2 of this section.
   • Windows Me users: Click Start, point to Programs, point to Accessories, and then click MS-DOS Prompt. This opens a DOS window at the C:Windows prompt. Go on to step 2 of this section.
   • Windows NT/2000 users:
     1. Click Start, and click Run.
     2. Type the following and then press Enter:
        
        command
        
        A DOS window opens.
        
     3. Type the following and then press Enter:
        
        cd winnt
        
     4. Go on to step 2 of this section.
   • Windows XP:
     1. Click Start, and click Run.
     2. Type the following and then press Enter:
        
        command
        
        A DOS window opens.
        
     3. Type the following and then press Enter after typing each one:
        
        cd
        cd windows
        
     4. Proceed to step 2 of this section.
        
2. Type the following and then press Enter:
   
   copy regedit.exe regedit.com
   
3. Type the following and then press Enter:
   
   start regedit.com
   
   The Registry Editor will open in front of the DOS window. After you finish editing the registry, exit the Registry Editor, and then exit the DOS window, as well.
   

1. Proceed to the next section, "To edit the registry" only after you have accomplished the previous steps.


To edit the registry:

CAUTION: Symantec strongly recommends that you back up the registry before you make any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify only the keys that are specified. Read the document How to make a backup of the Windows registry for instructions.

1. Navigate to and select the following key:
   
   HKEY_LOCAL_MACHINESoftwareClassesexefileshellopencommand
   
   CAUTION: The HKEY_LOCAL_MACHINESoftwareClasses key contains many subkey entries that refer to other file extensions. One of these file extensions is .exe. Changing this extension can prevent any files ending with an .exe extension from running. Make sure that you browse all the way along this path until you reach the command subkey.
   
   Modify the HKEY_LOCAL_MACHINESoftwareClassesexefileshellopencommand subkey that is shown in the following figure:
   
   <<=== NOTE: Modify this key.
   
2. In the right pane, double-click the (Default) value.
3. Delete the current value data, and then type: "%1" %* (That is, type the following characters: quote-percent-one-quote-space-percent-asterisk.)
   
   NOTES:
   • On Windows 95/98/Me and Windows NT systems, the Registry Editor automatically encloses the value within quotation marks. When you click OK, the (Default) value should look exactly like this:
     
     ""%1" %*"  
     
   • On Windows 2000/XP systems, the additional quotation marks will not appear. When you click OK, the (Default) value should look exactly like this:
     
     "%1" %*
     
   • Make sure that you completely delete all value data in the command key before you type the correct data. If you leave a space at the beginning of the entry, any attempt to run program files will result in the error message, "Windows cannot find .exe." If this happens to you, start over at the beginning of this document, and make sure that you completely remove the current value data.
     
4. Navigate to the key
   
   HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
   
5. In the right pane, delete the values that the worm added:
   
   AVPCC
   EFV_B regedit /s c:windowsefv_b.reg
   NAV Agent
   Norton Auto-Protect
   Norton eMail Protect
   TrueVector
   
6. Navigate to the key
   
   HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunServices
   
7. In the right pane, delete the value
   
   ScriptBlocking
   
8. Navigate to the key
   
   HKEY_CURRENT_USERSoftwareKazaaLocalContent
   
9. In the right pane, delete the value
   
   Dir0 012345:c:Program FilesKaZaAefv
   
10. Click Registry, and click Exit.

To scan for and delete the infected files:

1. Start your Symantec antivirus program, and make sure that it is configured to scan all files.
   • Norton AntiVirus Consumer products: Read the document How to configure Norton AntiVirus to scan all files.
   • Symantec Enterprise antivirus products: Read the document How to verify a Symantec Corporate antivirus product is set to scan All Files.
2. Run a full system scan.
3. If any files are detected as infected by W32.HLLW.Heffer or W97M.Heffer, click Delete.