Worm:Win32/Hikjav.A

Worm:Win32/Hikjav.A is a worm that spreads to all logical drives. It attempts to steal user names and passwords for web mail services by monitoring what a user enters via a web browser. It then sends all stolen information to a remote server.

When run, Worm:Win32/Hikjav.A copies itself as the hidden file "%USERPROFILE%\smss.exe".

 

It then modifies the system registry so that it runs every time Windows starts:

 

Adds value: "SysUtils"
With data: "%USERPROFILE%\smss.exe"
To subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Worm:Win32/Hikjav.A enumerates drives C: to Z:, checking for Removable, Fixed, and RAMDisk drive types. If a drive is of any of these drive types, the worm copies itself in the drive as the file "<Drive>\RECYCLER\autoplay.exe". It also creates a file named "autorun.inf" in the root of the drive, which automatically executes the worm copy if the drive is accessed and Autorun is enabled.

 

The file "autorun.inf" is detected as Worm:Win32/Hikjav.A!inf.

Worm:Win32/Hikjav.A attempts to steal user names and passwords for web mail services by monitoring when a user enters details via a web browser. It then sends the information to the remote server "razmgah.com".

To make its removal more difficult, this worm cycles through its installation, propagation, and payload routines after a certain time interval passes.