Threat Description



Category: Malware
Type: Worm
Platform: W32
Aliases: Wallon, I-Worm.Wallon, W32/Wallon.worm, W32/Wallon.A@mm


We got several reports about Wallon worm on May 11th, 2004. The worm sends HTML-based messages via e-mail. These messages contain links that use Yahoo redirection service to direct users' web browsers to the website where there's a script that downloads and runs additional worm's components.


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More scanning & removal options

More information on scanning or removal options is available in the documentation for your F-Secure security product on the Downloads section of our Home - Global site.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

For further assistance, F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.

Technical Details

Wallon is an email worm that does not send itself as an attachment. Instead it sends a link in a HTML message. The link is made to look like a link to Yahoo pages, and once user clicks on the link, it uses the Yahoo redirection service to open another web page that downloads "terra.html". The "terra.html" contains an encypted link to another "count.html" page. This page uses the object data vulnerability to downloand and run the "sys.chm" file. The "sys.chm" file uses the XMLHTTP/ADODB to download a binary file called "sys.exe". This file overwrites the Windows Media Player file "wmplayer.exe".

The downloaded "sys.exe" binary will be executed whenever a user opens Windows Media Player either directly or via a web page.

The SYS.EXE file is a downloader. It downloads a file called NOT.EXE and puts it as ALPHA.EXE into the root folder of C: drive. Then this file is activated. Additionally the downloader changes startup search pages of Internet Explorer to point to the following website:

The main worm's file ALPHA.EXE is a PE executable about 150 kilobytes long packed with ASPack file compressor.

When the worm's file is run, it checks the value of the following Registry key:

[HKCU\SOFTWARE\Microsoft\Internet Explorer\Main]  "Wh" = ?   

If the value is equal to 'Yes', the worm waits for 5 hours and then opens the website with the default web browser. Then the worm keeps opening that website every 10 minutes and does it 10 times.

If that Registry key doesn't exist, the worm creates it. Then it reads user's SMTP settings from the Registry, locates and opens a WAB (Windows Address Book) file and sends e-mail messages to all found addresses. E-mails sent by the worm look like that:

The link contains the domain name of a recipient.

The worm doesn't send e-mails to addresses that contain any of the following substrings:

microsoft  support  software  webmaster  postmaster  admin  +   

Additionally the worm sends an empty message to the address. This may be done to collect e-mail addresses of people whose computers are infected by the worm.

If user's Address Book is empty, an error messagebox is shown. On our test system it looked like that:


Detection for the main Wallon worm component was published on May 7th, 2004 in the following F-Secure Anti-Virus updates:

Detection Type: PC
Database: 2004-05-07_01

Detection for additional Wallon worm components was published on May 11th, 2004 in the following F-Secure Anti-Virus updates:

Detection Type: PC
Database: 2004-05-11_04

Technical Details:Alexey Podrezov, Sami Rautiainen and Katrin Tocheva, May 11th, 2004


Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More