W32.HLLC.Happylow

W32.HLLC.Happylow is a companion virus that encrypts all .exe files that reside in the same folder as the virus and renames them with a .wal extension. It then makes a copy of itself as the original file name.

For example, the virus encrypts the file Calc.exe and renames it to Calc.wal. Then the virus copies itself as Calc.exe, so that when the infected Calc.exe is executed, the virus executes its routine. Finally, it decrypts the Calc.wal file and executes it to make it appear that Calc.exe has run normally.

Protection

• Initial Rapid Release version September 10, 2002
• Latest Rapid Release version July 19, 2008 revision 019
• Initial Daily Certified version September 10, 2002
• Latest Daily Certified version July 19, 2008 revision 018
• Initial Weekly Certified release date September 10, 2002

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Low

Distribution

• Distribution Level: Low