Category: Malware

Type: Worm

Aliases: Wallon, I-Worm.Wallon, W32/Wallon.worm, W32/Wallon.A@mm


We got several reports about Wallon worm on May 11th, 2004. The worm sends HTML-based messages via email. These messages contain links that use Yahoo redirection service to direct users' web browsers to the website where there's a script that downloads and runs additional worm's components.


Automatic action

Based on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the detected program or file, or ask you for a desired action.

Knowledge Base

Find the latest advice in our Community Knowledge Base.

About the product

See the manual for your F-Secure product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details

Wallon is an email worm that does not send itself as an attachment. Instead it sends a link in a HTML message. The link is made to look like a link to Yahoo pages, and once user clicks on the link, it uses the Yahoo redirection service to open another web page that downloads "terra.html". The "terra.html" contains an encypted link to another "count.html" page. This page uses the object data vulnerability to downloand and run the "sys.chm" file. The "sys.chm" file uses the XMLHTTP/ADODB to download a binary file called "sys.exe". This file overwrites the Windows Media Player file "wmplayer.exe".

The downloaded "sys.exe" binary will be executed whenever a user opens Windows Media Player either directly or via a web page.

The SYS.EXE file is a downloader. It downloads a file called NOT.EXE and puts it as ALPHA.EXE into the root folder of C: drive. Then this file is activated. Additionally the downloader changes startup search pages of Internet Explorer to point to the following website:

The main worm's file ALPHA.EXE is a PE executable about 150 kilobytes long packed with ASPack file compressor.

When the worm's file is run, it checks the value of the following Registry key:

[HKCU\SOFTWARE\Microsoft\Internet Explorer\Main]
"Wh" = ?

If the value is equal to 'Yes', the worm waits for 5 hours and then opens the website with the default web browser. Then the worm keeps opening that website every 10 minutes and does it 10 times.

If that Registry key doesn't exist, the worm creates it. Then it reads user's SMTP settings from the Registry, locates and opens a WAB (Windows Address Book) file and sends email messages to all found addresses. emails sent by the worm look like that:

The link contains the domain name of a recipient.

The worm doesn't send emails to addresses that contain any of the following substrings:


Additionally the worm sends an empty message to the address. This may be done to collect email addresses of people whose computers are infected by the worm.

If user's Address Book is empty, an error messagebox is shown. On our test system it looked like that: