Payload: Will delete 5 files from the computer. Will also attempt to format the C Drive the next time the computer
restarts (Windows 95/98/Me).
Large scale e-mailing: Mails itself to all addresses in the Outlook Address book
Deletes files: Deletes 5 files with the extension .xls, .doc, .wav, .dwg, .mp3, .bak, .cdx, .bmp, .htm, .hlp, .chm,
.jpg, .cdr, .mdb, .dbf, or .ico,
Modifies files: Modifies Autoexec.bat to format the C Drive
Causes system instability: Deletes files used by the Windows Me Operating System to restore corrupted files.

W32.Hunch.C@mm is a mass-mailing worm. If it is run, it does the following:

1. It sends itself to all contacts in the Microsoft Outlook address book. The message has the following characteristics:

Subject: <This varies depending on the originating file name>
Message: Tal como te prometi; te envio mi foto en el archivo adjuncto...
Attachment: <This varies depending on the originating file name>

2. It displays a pornographic picture.
3. It searches the C:\_RESTORE folder (Windows Me only) and deletes all .ocx, .sys, and .dll files from that folder.
4. It copies itself as:
• C:\Windows\System\Msoffice.Exe
• C:\Windows\System\Thd16.Exe
• C:\Windows\System\<Attachment file name>
5. It adds the value

THD16     C:\Windows\System\Thd16.Exe

to the registry key

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

so that the worm runs when you start Windows.

6. It then deletes five files that have one of the following randomly chosen file extensions:
• .xls
• .doc
• .wav
• .dwg
• .mp3
• .bak
• .cdx
• .bmp
• .htm
• .hlp
• .chm
• .jpg
• .cdr
• .mdb
• .dbf
• .ico
  
  NOTE: It keeps a log of the deleted files in C:\Windows\System\ListWin.txt.
  
7. Finally, it modifies the C:\Autoexec.bat file by adding the following command:

DEL  > FORMAT C: /u /v:THD16 /autotest

so that the next time that you start the computer (Windows 95/98/Me only) the hard drive is reformatted.

1. Obtain the most recent virus definitions. There are two ways to do this:
• Run LiveUpdate. LiveUpdate is the easiest way to obtain virus definitions. These virus definitions have undergone full quality assurance testing by Symantec Security Response and are posted to the LiveUpdate servers one time each week (usually Wednesdays) unless there is a major virus outbreak. To determine whether definitions for this threat are available by LiveUpdate, look at the Virus Definitions (LiveUpdate) line at the top of this write-up.
• Download the definitions using the Intelligent Updater. Intelligent Updater virus definitions have undergone full quality assurance testing by Symantec Security Response. They are posted on U.S. business days (Monday through Friday). They must be downloaded from the Symantec Security Response Web site and installed manually. To determine whether definitions for this threat are available by the Intelligent Updater, look at the Virus Definitions (Intelligent Updater) line at the top of this write-up.
  
  Intelligent Updater virus definitions are available here. For detailed instructions on how to download and install the Intelligent Updater virus definitions from the Symantec Security Response Web site, click here.
  
2. Start Norton AntiVirus (NAV), and make sure that NAV is configured to scan all files. For instructions on how to do this, read the document How to configure Norton AntiVirus to scan all files.
3. Run a full system scan.
4. If any files are detected as infected by W32.Hunch.C@mm, delete them.
5. To be sure that all infected files have been removed, use Windows Explorer to look for and delete the following files:
• C:\Windows\System\Msoffice.Exe
• C:\Windows\System\Thd16.Exe
• (Optional) C:\Windows\System\ListWin.txt (Deleting this file is optional. It contains a list of some of the deleted files. You may want to save this file to help you restore files that the worm deleted.)

1. Click Start, and click Run. The Run dialog box appears.
2. Type regedit and then click OK. The Registry Editor opens.
3. Navigate to the following key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

4. In the right pane, delete the following value:

THD16     C:\Windows\System\Thd16.Exe

5. Click Registry, and then click Exit.

1. Click Start, and click Run.
2. Type the following, and then click OK:

edit c: autoexec.bat

The MS-DOS Editor opens.

3. Look for the line

DEL  > FORMAT C: /u /v:THD16 /autotest

4. If it exists, select the entire line. Be sure that you do not select any other text, and then press Delete.
5. Click File, and click Save.
6. Click File, and click Exit.