Hairy HP Computer Virus
The HP Hairy-A worm poses as a file containing a copy of HP (Harry Potter) and the Deathly Hallows, the eagerly-anticipated final novel in the Harry Potter series, due out on 21 July. The infected file normally comes on infected USB drives. If users plug these drives into their Windows PCs they are liable to infect their machines, especially if they have allowed USB drives to "auto-run".
Infected drives contain a file called HarryPotter-TheDeathlyHallows.doc, a word document that contains nothing besides the phrase "Harry Potter is dead", instead of the hoped-for transcript. Meanwhile, behind the scenes, the worm begins casting its malign spell. The worm looks for other removable drives to infect before creating a number of new users (Harry Potter, Hermione Granger, and Ron Weasley) that will be familiar names to fans of the JK Rowling books.
After logging in, users of infected machines will be confronted by the following message, which appears via a batch file: read and repent the end is near repent from your evil ways O Ye folks lest you burn in hell... JK Rowling especially.
The worm also changes the Internet Explorer home page of compromised machines to an Amazon.com web page selling a parody book of the teenage wizard series entitled Harry Putter and the Chamber of Cheesecakes.
The HP Hairy-A worm malware as an "old school" virus written to cause mischief and to show off. PC Users are advised to disable the auto-run facility of Windows so removable devices such as USB keys and CD ROMs do not automatically launch when they are attached to a PC. Removal media ought to be checked for malware before use in order to guard against the increased use of USB devices and the like as a vector for malware distribution.
Hairy-A is a worm for the Windows platform. Hairy-A will attempt to copy itself and create autorun.inf to removable drives. When Hairy-A is installed the following files are created:
\HarryPotter-TheDeathlyHallows.doc
\autorun.inf
\harry potter.txt
\Tempt\talk.bat
The following registry entry is created to run talk.bat on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run - talk - \Tempt\talk.bat
W32/Hairy-A changes settings for Microsoft Internet Explorer by modifying values under:
HKCU\Software\Microsoft\Internet Explorer\Main\
HKCU\Software\Microsoft\Internet Explorer\Main\Start Page
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
The following registry entries are set, affecting internet security:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\
Parameters\FirewallPolicy\StandardProfile
EnableFirewall = 0
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\
Parameters\FirewallPolicy\StandardProfile
DoNotAllowExceptions = 0
The following registry entries are set, disabling system software:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr = 1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools = 1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
DisableTaskMgr = 1
Registry entries are set as follows:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoFolderOptions = 1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoViewContextMenu = 1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoShellSearchButton = 1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoFind = 1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoRun = 1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HideClock = 1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoTrayContextMenu = 1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoTrayItemsDisplay = 1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
NoViewContextMenu = 1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
Advanced\Folder\Hidden\SHOWALL
CheckedValue = 0
Updated On: 15.10.06