H-Worm

H-Worm also referred to as the Houdini Worm, is a backdoor Trojan that may compromise your PC by giving access to it to a remote attacker. H-Worm includes potential features dedicated to collect information and also may install new threats or make other, equally drastic changes to your PC's file system. Malware researchers recommend using professional anti-malware tools for removing H-Worm, based on the relative sophistication of this Trojan's code.

The Trojan that may Pull a Vanishing Act (But Probably Will Not)

In spite of the name, H-Worm is not a worm, but a backdoor Trojan, and is designed with all of the standard 'features' of such a threat in mind. Malware experts have verified at least two variants of H-Worm, one based on the AutoIT script and another version based on Visual Basic Script. However, in both cases, H-Worm shows identical capabilities, although an embedded self-updating function could allow H-Worm to change itself conditionally.

Many, similar Trojans exist for targeting either the public at large or specific entities (such as corporations or government systems), but H-Worm is exceptional for being used against both categories of victims. Common distribution methods for the Trojan exploit corrupted e-mail messages with file attachments for installing H-Worm. The H-Worm, itself, is protected by several layers of code obfuscation to prevent common security tools from identifying H-Worm during scans.

Most backdoor Trojans, inclusive of H-Worm, may rapidly balloon into major security problems, due to the flexibility of may include:

• H-Worm may delete itself if instructed to do so, although H-Worm may not necessarily delete any other threats that H-Worm may have installed.
• H-Worm may download files from multiple sources, including C&C-specific servers or general URLs.
• Any files H-Worm downloads also may execute on command, which may allow H-Worm to install other software and threats.
• H-Worm may exercise direct control over your memory processes, such as terminating the process of an undesired program (like your anti-virus software).

By default, H-Worm also may harvest basic system information for transmission to its Command & Control server. This server infrastructure appears to have notable ties to other backdoor-capable threats, such as Njw0rm and Backdoor.Ratenjay (njRAT), naturally raising the suspicion of the developers being cooperative or otherwise acquainted.

Stopping Your PC from Becoming H-Worm's Stage

Backdoor Trojans, sometimes called Remote Access Trojans (or RATs), are notable for the invasive degree of security compromises that tend to accompany them. While H-Worm may not show any clear symptoms of its installation, an H-Worm infection may give a remote attacker nearly unrestricted access to the files, settings and programs on your PC. Since H-Worm's distribution methods frequently lean on e-mail-based strategies, scanning all e-mail attachments before opening them is one of the clearest ways of limiting its attacks. Once installed, H-Worm may show no symptoms unless instructed to do so by its controller, although PC users may be able to detect the traces of its unwanted network activities.

Because H-Worm may include a hibernation function, malware experts especially advise against assuming any lack of symptoms indicates the successful removal of this threat. In most practical scenarios, deleting H-Worm should be done by qualified and updated anti-malware products. Further steps also may need to be taken to limit any other ill effects from H-Worm's presence, such as changing passwords that H-Worm could have gathered.