W32/Oror.A is an email worm. This worm infects Windows systems. It carries its own SMTP engine, to email itself to all email addresses in the incoming emails. W32/Oror.A also spreads over mIRC and shared networks.

The email carrying the worm arrives with a subject and text randomly chosen from a set maintained by it.

The email carries an infected attachment with any one of the following names;

Blondies.exe
Candy.exe
Faith.exe
Fun.exe
Kama Sutra.exe
Love.exe
Love Zodiak.exe
Magic.exe
mTV.exe
mTV Charts.exe
Osama Your Mamma.exe
Pamela.exe
Panda Anti-Worm.exe
Setup.exe
Smile.exe
Sorry.exe
TNT!CC gEN.exe
TNT!CC geN.exe
Zodiak.exe

The first time it is executed, the worm displays a fake error message;

"WinZip Self-Extractor License Confirmation Your version of WinZip Self-Extractor is not licensed, or the license information is missing or corrupted. Please contact the program vendor or the web site (www.WinZip.com) for additional information."

After displaying this message, the worm copies itself to the Windows folder as Rundll16.exe. It then modifies the registry at the following location to load itself during each system startup:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

It also modifies WIN.INI file to load itself during each startup. It copies itself under a filename, randomly chosen from the files listed under Windows System folder, and adds a suffix to it.

The worm sends itself to email addresses of all the incoming mails. It also tries to copy itself to network shares using random names.

The worm has a payload which deletes files related to various security software.

This worm first appeared on 28th August 2002.

Other names of W32/Oror.A worm:

This worm is also known as WORM_OROR.A and W32.HLLW.Oror@mm