Description
Win32.Hiton is an internet worm which affects computers running under Windows 95/98/Me/NT/2000/XP operating systems. It may arrive to users computers as .exe or .dll file, or be packed with WinZip. Regardless the extension its size is 44, 036 bytes.
The worm is capable of disseminating via e-mail and file-sharing networks.
Launching
To secure automatic execution of its copy SVCHOST.EXE at every Windows startup the worm changes two registry entries
Its .dll-formatted copy is also registered in the system registry
\\\"Service Host Driver\\\" = %WinDir%\\\\SVCHOST.EXE
AutoRun = \\\"C:\\\\WINNT\\\\SVCHOST.EXE\\\"
HKEY_CURRENT_USER \\\\CLSID\\\\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\\\\
InProcServer32\\\\ (Default) = \\\"%SysDir%\\\\MSSVC.DLL\\\"
Spreading
Via e-mail
The worm can spread via –email using its own SMTP engine. In search of addresses it scans hard drives of the affected machine. The files with the following extensions are revised:
.htm
.mht
.hlp
.dbx
.eml
.tbb
.txt
.wab
The worm stores the retrieved addresses in wsick32.dll, created in the System folder. The mail message infected with the worm may look as follows:
The sender’s address is spoofed.
There can be no subject, or it may be chosen from the following list of possible subject (just few of them are sited here):
*, you have to see this!
hey wuts up?
hey wuts up*?
Very funny
Useful
Hiiiiiii
Wait for more :)
warning
something for you
read it immediately
Undeliverable mail --
Server Report
Mail Delivery System
here´s the document you requested
here´s the document
Pr0n!
Here´s a nice Picture
here´s the archive you requested
New Internal Rls...
Do not release, its the internal rls!
hello*
hello
hi*
hi
Error
Ciao*
Ciao
where * is a recipient’s name. The attachment may have the following names:
document
body
mail
msg
doc
talk
message
creditcard
details
attachment
me
stuff
posting
textfile
concert
information
note
bill
swimmingpool
product
topseller
ps
shower
aboutyou
nomoney
found
story
mails
website
friend
jokes
location
final
release
dinner
ranking
object
mail2
part2
disco
party
misc
The extension of the attachment may be. exe. .src, .htm (multiple spaces) .exe.
Propagation through file-sharing networks and mapped drives
The worm can spread through file-sharing networks. For this, it creates its own folder .{21EC2020-3AEA-1069-A2DD-08002B30309D} and copies itself there as key generator files or cracking utilities.
Action
Being executed, the worm drops two copies of itself into the System:
The worm may displays the following message:
-
Title: Connection Error 66473:
Text: Please check your Internet Connection or Firewall. If the Error occurs again you should Contact your ISP.
-
Title: svchost.exe
Text: successfully uninstalled. please reboot.
