W32/Higuy Worm

 Information about the W32/Higuy worm:

W32/Higuy is an email worm. This worm will infect Windows systems. It spreads using the email addresses present in Windows address book.

It arrives with one of the following subjects:

Incredibile..
or Incredible..
or Urgente! (vedi allegato)
or Qualsiasi cosa fai, falla al meglio.

The body of the mail contains one of the following message:

Hello,
see this interesting file.
Bye.

or Ciao,
apri subito l'allegato,e' molto interessante.
A presto...

or Ciao,
devi assolutamente vedere il file che ti ho allegato.
A presto...

or Ciao,
okkio all'allegato ;-)
A presto...

The infected mail will contain any one of the following attachments tettona.exe or euro.exe or tatto.exe.

Upon execution of infected attachment, it displays a message box with the title Error. It displays a message VBRUN49.DLL not found! Unable to execute.

The worm copies itself as DLLMGR32.EXE under Windows folder. After this, the worm collects email addresses from Windows address book and mails a copy of itself to all the recipients. The worm creates a file called DLLMGR32.DAT indicating the delivery of worm mail to the recipients.

The worm creates registry entries at the following location to load itself at next startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

This worm first appeared on 14th June 2002.

 Other names of W32/Higuy worm:

This worm is also known as I-Worm.Tettona, Win32.Frantes.A, WORM_HIGUY.A.