W32/Tiotua-CH is a worm for the Windows platform.
W32/Tiotua-CH includes functionality to:
- copy itself to the <WINDOWS> folder
- run automatically
- copy itself to the <System> folder
When W32/Tiotua-CH is installed the following files are created:
<System>\blastclnnn.exe
<System>\scvshosts.exe
<Windows>\hinhem.scr
<Windows>\scvshosts.exe
Registry entries are set as follows:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies
Explorer
NofolderOptions
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
Winlogon
Shell