W32/Higuy-A ; Aliases: I-Worm.Tettona

Discussion in 'malware problems & news' started by FanJ, Jun 14, 2002.

Thread Status:
Not open for further replies.
  1. FanJ

    FanJ Guest

    Name: W32/Higuy-A
    Aliases: I-Worm.Tettona
    Type: Win32 worm
    Date: 14 June 2002

    At the time of writing Sophos has received just one report of
    this worm from the wild.


    W32/Higuy-A is an internet worm with backdoor capabilities. It
    spreads via email by sending itself to addresses found in the
    Windows address book.

    The email will have the following characteristics:
    English version:
    Subject: Incredible..
    Message text:
    see this interesting file.

    Italian version:
    "Qualsiasi cosa fai,falla al meglio." or
    "Urgente! (vedi allegato)" or

    Message text:
    line 1: Ciao,
    line 2:
    "okkio all'allegato ;-)" or
    "apri subito l'allegato,e' molto interessante." or
    "devi assolutamente vedere il file che ti ho allegato."
    line 3: A presto...

    Attached file: tattoo.exe, euro.exe or tettona.exe.

    When run for the first time the worm displays the fake error
    "VBRUN49.DLL not found! Unable to execute.". Then it copies
    itself into the Windows folder as dllmgr32.exe. It sets the
    following registry entry so that it will be automatically run
    when Windows starts up.

    HKLM\Software\Microsoft\Windows\CurrentVersion\Run\DllManager =

    Read the analysis at
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.