A new worm called Wallon was discovered in Europe on May 11, 2004. Any computer infected by this worm will have its Windows Media Player wiped out when the user tries to play MP3 or video files from the infected PC.

 

Wallon is a so-called mass-mailing worm that will spread itself to a lot of email addresses and its infection process is complicated. Unlike the ordinary e-mail worm that arrives as an attachment file in an e-mail, Wallon appears as a link in a message to a Yahoo page. But with redirection any unsuspecting user clicking the faked link would download and install the Wallon worm onto their PCs.

 

Once the PC is infected, Wallon will not be activated until the user runs a media file such as an MP3 or a video. When the worm is activated, it would send HTML e-mails, each with a link to the virus file, to the addresses in the computer’s e-mail address book.

 

Wallon can not spread very quickly because it requires users to click the faked links before it can replicate. But it is destructive because it wipes out the wmplayer.exe file, causing infected PCs not able to play media files with Windows Media Player.

 

BroadWeb suggests that NetKeeper users upgrade their signature patterns to version 2.40 immediately, which can detect Wallon worm and throw the worm away.