W32/Philis.BR is a worm. The worm will infect Windows systems. The worm spreads through network.

Upon execution, the worm copies itself as rundl132.exe and Dll.dll in Windows folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Windows

This worm infects the exeutable files found on the infected system. It also attempts to copy itself to remote network shares, and at the same time it sends ICMP packets with a message "Hello,World".

The worm also creates _desktop.ini in every folder that it visits on the infected computer.

The worm avoids infecting executable files in the following folders;

WindowsUpdate
Windows Media Player
Outlook Express
Internet Explorer
ComPlus Applications
NetMeeting
Common Files
Messenger
Microsoft Office
InstallShield Installation Information
Microsoft Frontpage
Movie Maker
MSN Gaming Zone
system
system32
winnt
windows
Recycled
Documents and Settings
System Volume Information

The worm also terminates some of the security related processes.

This worm first appeared on November 19, 2006.

 Other names of W32/Philis.BR Worm:

This Worm is also known as W32/HLLP.Philis.br, PE_LOOKED.JR, Worm.Win32.Viking.ay.