W32.HLLW.Lioten

W32.HLLW.Lioten is a simple worm that attempts to copy itself over Windows NT-based networks. The worm is written in the Visual C programming language and is packed with UPX.

When attempting to find machines to infect, it will query machines on port 445.



By default, installations of Windows NT 4 do not listen on port 445, whereas Windows 2000 and Windows XP installations do listen on port 445.

Protection

• Initial Rapid Release version December 17, 2002
• Latest Rapid Release version July 19, 2008 revision 019
• Initial Daily Certified version December 17, 2002
• Latest Daily Certified version January 20, 2009 revision 048
• Initial Weekly Certified release date December 18, 2002

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 50 - 999
• Number of Sites: More than 10
• Geographical Distribution: High
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Medium

Distribution

• Distribution Level: Medium