Threat description




We got several reports about Wallon worm on May 11th, 2004. The worm sends HTML-based messages via e-mail. These messages contain links that use Yahoo redirection service to direct users' web browsers to the website where there's a script that downloads and runs additional worm's components.


Automatic action

Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.

More scanning & removal options

More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.

Technical Details

Wallon is an email worm that does not send itself as an attachment. Instead it sends a link in a HTML message. The link is made to look like a link to Yahoo pages, and once user clicks on the link, it uses the Yahoo redirection service to open another web page that downloads "terra.html". The "terra.html" contains an encypted link to another "count.html" page. This page uses the object data vulnerability to downloand and run the "sys.chm" file. The "sys.chm" file uses the XMLHTTP/ADODB to download a binary file called "sys.exe". This file overwrites the Windows Media Player file "wmplayer.exe".

The downloaded "sys.exe" binary will be executed whenever a user opens Windows Media Player either directly or via a web page.

The SYS.EXE file is a downloader. It downloads a file called NOT.EXE and puts it as ALPHA.EXE into the root folder of C: drive. Then this file is activated. Additionally the downloader changes startup search pages of Internet Explorer to point to the following website: www.google.com.super-fast-search.apsua.com.

The main worm's file ALPHA.EXE is a PE executable about 150 kilobytes long packed with ASPack file compressor.

When the worm's file is run, it checks the value of the following Registry key:

[HKCU\SOFTWARE\Microsoft\Internet Explorer\Main]
"Wh" = ?

If the value is equal to 'Yes', the worm waits for 5 hours and then opens the pixpox.com website with the default web browser. Then the worm keeps opening that website every 10 minutes and does it 10 times.

If that Registry key doesn't exist, the worm creates it. Then it reads user's SMTP settings from the Registry, locates and opens a WAB (Windows Address Book) file and sends e-mail messages to all found addresses. E-mails sent by the worm look like that:

The link contains the domain name of a recipient.

The worm doesn't send e-mails to addresses that contain any of the following substrings:


Additionally the worm sends an empty message to the 1@600pics.cjb.net address. This may be done to collect e-mail addresses of people whose computers are infected by the worm.

If user's Address Book is empty, an error messagebox is shown. On our test system it looked like that:


Detection for the main Wallon worm component was published on May 7th, 2004 in the following F-Secure Anti-Virus updates:

Detection Type: PC

Database: 2004-05-07_01

Detection for additional Wallon worm components was published on May 11th, 2004 in the following F-Secure Anti-Virus updates:

Detection Type: PC

Database: 2004-05-11_04

Submit a Sample

Suspect a file or URL was wrongly detected? Send it to our Labs for further analysis

Submit a Sample

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

More Info