McAfee > Theat Center > Virus Detail Page

Overview

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Characteristics

The purpose of this trojan is to lower the security settings of Internet Explorer for the purposes of downloading and executing possibly unwanted content.

Installation

Upon execution, the application installs itself into the %Sysdir% directory as "hlhtxo.exe ".

(Where %Sysdir% is the Windows System directory, for example C:\WINDOWS\SYSTEM)

For example:

c:\windows\system32\hlhtxo.exe

The following Registry key(s) is/are added to hook system startup:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\neededware.com\www "http" = " 02, 00, 00, 00"
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run "hlhtxo" = "%Sysdir%\hlhtxo.exe" 
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "hlhtxo" = "%Sysdir%\hlhtxo.exe" = "%Sysdir%\hlhtxo.exe"
• HKEY_LOCAL_MACHINE\SOFTWARE\ndwserv030106 "ID" = "BD1AC9CD-B4AD-4A0E-9812-247CD43945D3"
• HKEY_LOCAL_MACHINE\SOFTWARE\ndwserv030106 "LastAppInstalled"
• HKEY_LOCAL_MACHINE\SOFTWARE\ndwserv030106 "LastUpdateCheck"
• HKEY_LOCAL_MACHINE\SOFTWARE\ndwserv030106 "Version" = "03.01.06.00"

The following site will be added to the trusted sites list in the Internet Explorer:

• www.neededware.com

Symptoms

Presence of the site listed above within the Trusted Sites list within the Internet Explorer.

Method of Infection

This trojan may be downlooaded and run by other trojan files. Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, email, etc.

Removal

All Users:
Use current engine and DAT files for detection. Delete any file which contains this detection.

Additional Windows ME/XP removal considerations

Variants

Variants

N/A

All Information

Overview -

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Characteristics

Characteristics -

The purpose of this trojan is to lower the security settings of Internet Explorer for the purposes of downloading and executing possibly unwanted content.

Installation

Upon execution, the application installs itself into the %Sysdir% directory as "hlhtxo.exe ".

(Where %Sysdir% is the Windows System directory, for example C:\WINDOWS\SYSTEM)

For example:

c:\windows\system32\hlhtxo.exe

The following Registry key(s) is/are added to hook system startup:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\neededware.com\www "http" = " 02, 00, 00, 00"
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run "hlhtxo" = "%Sysdir%\hlhtxo.exe" 
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "hlhtxo" = "%Sysdir%\hlhtxo.exe" = "%Sysdir%\hlhtxo.exe"
• HKEY_LOCAL_MACHINE\SOFTWARE\ndwserv030106 "ID" = "BD1AC9CD-B4AD-4A0E-9812-247CD43945D3"
• HKEY_LOCAL_MACHINE\SOFTWARE\ndwserv030106 "LastAppInstalled"
• HKEY_LOCAL_MACHINE\SOFTWARE\ndwserv030106 "LastUpdateCheck"
• HKEY_LOCAL_MACHINE\SOFTWARE\ndwserv030106 "Version" = "03.01.06.00"

The following site will be added to the trusted sites list in the Internet Explorer:

• www.neededware.com

Symptoms

Symptoms -

Presence of the site listed above within the Trusted Sites list within the Internet Explorer.

Method of Infection

Method of Infection -

This trojan may be downlooaded and run by other trojan files. Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, email, etc.

Removal -

Removal -

All Users:
Use current engine and DAT files for detection. Delete any file which contains this detection.

Additional Windows ME/XP removal considerations

Variants

Variants -

N/A