W32/Lioten Worm

 Information about the W32/Lioten worm:

W32/Lioten is a network worm. This worm attempts to spread across network shares. This worm infects Windows XP/2000 systems.

When the worm is active, it searches for a Windows XP/2000 in the network. The worm creates multiple threads to generate random IP addresses, which will be used by the worm to spread itself across the network. It tries to connect to shares like IPC$, C$ and ADMIN$ using a set of passwords in a list maintained by the worm.

After connecting to the remote computer, the worm copies itself as iraq_oil.exe to Windows/System32 folder. Later on the worm uses NetScheduleJobAdd function to schedule a task and execute the copied file in the target system.

This worm first appeared on 17th December 2002.

 Other names of W32/Lioten worm:

This worm is also known as  W32.Lioten, I-Worm.Lioten and W32.HLLW.Lioten.