Details
I-Worm.Hunch.a

This is a virus-worm that spreads via the Internet attached to infected e-mail. The worm itself is a Windows PE EXE file about 151 Kb in length, and it is written in Visual Basic.
Infected messages appear as follows:
Subject: COSTO
Body: Mensaje importante para %Recipient% en el archivo adjuntoall
(%Recipient% is the full name of the recipient.
Attachment: PE EXE file with a random name.

Installing
When the worm is launched, it creates a window containing a picture,

and installs into the system. When installing into the system, the worm copies itself to three files in the Windows system directory: one with the original name of the file, from which the worm has been launched and the following names:
%SYSTEM%\THWIN.EXE
%SYSTEM%\MSWORD.EXE
Then, the worm writes the following registry keys to start automatically with Windows:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices THWIN=%SYSTEM%\THWIN.EXE
HKLM\Software\Microsoft\Windows\CurrentVersion\Run THWIN=%SYSTEM%\THWIN.EXE
The worm also tries to copy itself to the A: drive with the “UNSCH.JPG.EXE” name.
Replication: e-mail
The worm uses Microsoft Outlook to send infected messages. The worm extracts e-mail addresses from the MS Outlook Address Book and sends itself to these addresses.
Payload
Depending on the worm’s internal counters, the worm writes disk a C: formatting command to the C:\Autoexec.bat file.

Details
I-Worm.Horillka

This malicious worm spreads via the Internet in the form of a file attached to infected messages. It is an encoded VBS script of 25562 bytes.
When downloaded Horilka decrypts itself.
It copies itself to the Windows system directory under the name WinSys32dll.vbs, and registers this file in the system registry autorun key.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\WinSys32dll.
The virus mass mails all addresses found in the Microsoft Outlook address book.
Characteristics of infected messages:
Message header:
÷ÎÉÍÁÎÉÅ!
Message body:
÷ÙÐÕÝÅÎÏ ÎÏ×ÏÅ vbs ÏÂÎÏ×ÌÅÎÉÅ ÄÌÑ ÐÏÉÓËÁ ×ÉÒÕÓÏ× × ÐÁÍÑÔÉ ïó Windows!
ïÎÏ ÐÏÍÏÇÁÅÔ ÂÏÒÏÔØÓÑ Ó ×ÉÒÕÓÁÍÉ, ÒÁÓÓÙÌÁÀÝÉÍÉÓÑ ÐÏ ÐÏÞÔÅ.
áÎÔÉ×ÉÒÕÓÎÙÊ ÍÏÄÕÌØ ÎÁÐÉÓÁÎ ÎÁ ÓËÒÉÐÔ-ÑÚÙËÅ, ÞÔÏ ÐÏÍÏÇÁÅÔ ÐÅÒÅÈ×ÁÔÙ×ÁÔØ
vb É js ×ÉÒÕÓÙ, ÐÒÅÖÄÅ ÞÅÍ ÏÎÉ ÎÁÞÎÕÔ ÄÅÓÔÒÕËÔÉ×ÎÕÀ ÄÅÑÔÅÌØÎÏÓÔØ.
äÏÓÔÁÔÏÞÎÏ ÏÔËÒÙÔØ ÆÁÊÌ É ÐÒÏÇÒÁÍÍÁ ÐÏ ÕÓÔÒÁÎÅÎÉÀ ×ÉÒÕÓÏ× ÐÒÏ×ÅÄÅÔ ÐÏÉÓË
×ÒÅÄÏÎÏÓÎÙÈ ÐÒÏÇÒÁÍÍ × ÐÁÍÑÔÉ ËÏÍÐØÀÔÅÒÁ.
Attachment:
a VBS script,
WinSys32.dll.vbs
Once messages have been sent, the virus sends its author a message which includes all .pwl (password) files found in the Windows directory.
Messages are sent once, when each user’s configuration is loaded.
The virus copies itself to all disks and all directories under the name of Folderdll.vbs and marks these files as hidden.
It searches the Windows folder for files with the following extensions:
.vbs
.jpg
.jpeg
.gif
.bmp
.htm
.html
.avc
.txt
.doc
.mp3
.wav
.dbf
Horilka overwrites .vbs files with its own code.
It replaces .jpg, .jpeg, .gif and .bmp files with a GIF format graphic contained in the body of the virus.
It adds the following code to .htm and.html files: