W32/Winevar is an email worm. This worm infects Windows systems. It also carries a variant of the W32/Funlove virus. The worm sends email to the email addresses found in the .htm and .dbx files in the local system.The worm infected email has the following characteristics:

The worm infected email has the following characteristics:

Subject;

AVAR(Association of Anti-Virus Asia Reseachers)

The body of the mail contains;

AVAR(Association of Anti-Virus Asia Reseachers) - Report. Invariably, Anti-Virus Program is very foolish.

It carries two infected attachments with file names MUSIC_1.HTM and MUSIC_2.CEO or WIN(followed by a combination of some characters), with the following extensions .TXT, .GIF, .PIF .

Upon execution of the infected attachment, it displays a dialog box with a message,
"What a foolish thing you have done!". After this, it creates a Registry entry at the following location to load itself each time Windows is restarted.

HKLM\Software\Microsoft\Windows\CurrentVersion\Run and HKCU\Software\Microsoft\Windows\CurrentVersion\Run.

The worm drops a file, AAVAR.PIF, which is infected by a variant of the W32/Funlove virus. The worm attempts to execute these files. Later on, using its own SMTP engine, it attempts to mail itself to all the email addresses found in the local system. The worm also attempts to disable antivirus software.

This worm first appeared on 22nd November 2002.

Other names of W32/Winevar worm:

This worm is also known as W32.HLLW.Winevar, WORM_WINEVAR.A, W32/Korvar.