Discussion in 'malware problems & news' started by Pieter_Arntz, Nov 11, 2002.

Thread Status:
Not open for further replies.
  1. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Apr 27, 2002
    W32.Hobble.F@mm is a variant of the W32.Hobble@mm worm. It attempts to spread across the KaZaA file-sharing network. It also sends itself to email addresses that it retrieves from .htm and .html files that it finds in the Internet Explorer cache, and to all addresses in the Microsoft Outlook Address Book. The email has the following characteristics:

    Subject: RE:
    Attachment: The email has two attachments. The first one is a copy of the worm, which is 18,432 Bytes in length. The second attachment is a random length text file.

    The threat is written in the Microsoft Visual Basic Programming Language and compressed with UPX.

    NOTE: Definitions dated prior to November 8, 2002 may detect this threat as W32.Alcatap.Worm


    Link has to be copied and pasted due to @ sign
    (Have fun harvesters :D )


Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.