Holar Removal Tool Malware

Holar Removal Tool - Clean the Holar malware

An effective way of cleaning the Holar malware

Holar Removal Tool is a useful application that was created in order to erase the Win32.Holar.H@mm worm.

The virus was written in Visual Basic and compressed with UPX.

When run, it will copy itself as HAwa.pif and will drop its embedded components: smtp.ocx (an SMTP ActiveX control used to send email messages; this component is registered using regsvr32) and the executable explore.exe.

The registry entry

[HKLM\Software\Microsoft\Windows\CurrentVersion\run\Explore]

is created to run the worm at every start-up. The executable's read-only, hidden and system file attributes are set.

An empty file 0.mpeg is created and open (usually, with Media Player); this is probably meant to trick users to believe they had actually downloaded a (corrupted) multimedia file.

Copies of the worm are created in the Windows System folder with the following names:

Hot_Show.pif

Short_vClip.pif

Broke_ass.pif

Beauty_VS_Your_FaCe.pif

Endless_life.pif

Hearts_translator.pif

Shakiraz_Big_ass.pif

Sweet_but_smilly.pif

Lo0o0o0o0oL.pif

Gurls_Secrets.pif

Tedious_SeX.pif

Leaders_Scandals.pif

HaWawi_N_Hawaii.pif

Come_2_Cum.pif

Tears_of_Happiness.pif

White_AmeRica.pif

Famous_PpL_N_Bad_Setuations.pif

XxX_Mpegs_Downloader.pif

Teenz_Raper.pif

Real_Magic.pif

The_Truth_of_Love.pif

unfaithful_Gurls.pif

How_to_improve_ur_love.pif

AniMaL_N_Burning_Ladies.pif

Aint_it_Funny.pif

ToolAv01w32.pif

The virus scans for target email addresses in .txt, .htm, .html, .dbx files and in Internet Explorer's cache. The format of the emails sent is chosen from various combinations of Subject line and Body and the attachment is one of the files named above.


The virus will also attempt to copy itself in the Kazaa shared folder if this file sharing application is installed, using the names listed above. This way, other Kazaa users might download it from the infected user.


The registry entry


[HKCU\DeathTime]


is initialized with 0 when the virus is installed; each time the virus is run again (when Windows is restarted), the value of the entry is incremented; when it reaches 30, the virus attempts to delete all .exe, .jpg, .doc, .pps, .ram, .zip files, and it displays several message boxes.


Finally, the virus will shutdown Windows; the operating system and all installed applications will have to be reinstalled.

Holar Removal Tool Malware is licensed as Freeware for the Windows operating system / platform. Holar Removal Tool is provided as a free download for all software users (Freeware).