Holar Removal Tool

Holar Removal Tool is a useful application that was created in order to erase the Win32.Holar.H@mm worm.
The virus was written in Visual Basic and compressed with UPX.
When run, it will copy itself as HAwa.pif and will drop its embedded components: smtp.ocx (an SMTP ActiveX control used to send email messages; this component is registered using regsvr32) and the executable explore.exe.
The registry entry
[HKLM\Software\Microsoft\Windows\CurrentVersion\run\Explore]
is created to run the worm at every start-up. The executables read-only, hidden and system file attributes are set.
An empty file 0.mpeg is created and open (usually, with Media Player); this is probably meant to trick users to believe they had actually downloaded a (corrupted) multimedia file.
Copies of the worm are created in the Windows System folder with the following names:
Hot_Show.pif
Short_vClip.pif
Broke_ass.pif
Beauty_VS_Your_FaCe.pif
Endless_life.pif
Hearts_translator.pif
Shakiraz_Big_ass.pif
Sweet_but_smilly.pif
Lo0o0o0o0oL.pif
Gurls_Secrets.pif
Tedious_SeX.pif
Leaders_Scandals.pif
HaWawi_N_Hawaii.pif
Come_2_Cum.pif
Tears_of_Happiness.pif
White_AmeRica.pif
Famous_PpL_N_Bad_Setuations.pif
XxX_Mpegs_Downloader.pif
Teenz_Raper.pif
Real_Magic.pif
The_Truth_of_Love.pif
unfaithful_Gurls.pif
How_to_improve_ur_love.pif
AniMaL_N_Burning_Ladies.pif
Aint_it_Funny.pif
ToolAv01w32.pif
The virus scans for target email addresses in .txt, .htm, .html, .dbx files and in Internet Explorers cache. The format of the emails sent is chosen from various combinations of Subject line and Body and the attachment is one of the files named above.
The virus will also attempt to copy itself in the Kazaa shared folder if this file sharing application is installed, using the names listed above. This way, other Kazaa users might download it from the infected user.
The registry entry
[HKCU\DeathTime]
is initialized with 0 when the virus is installed; each time the virus is run again (when Windows is restarted), the value of the entry is incremented; when it reaches 30, the virus attempts to delete all .exe, .jpg, .doc, .pps, .ram, .zip files, and it displays several message boxes.
Finally, the virus will shutdown Windows; the operating system and all installed applications will have to be reinstalled.