Hot Canada

Overview

Summary

Hot Canada is a 'dialer' by nature. The loose sequence of events upon execution is as follows: After CANADA.EXE is executed, it pops up a dialog that displays a pornographic image and asks the user if they would like to go to a porn site. Meanwhile, behind the scenes... It downloads HOT_CANADA.EXE from either 208.192.120.56 and 204.177.92.205 (via HTTP/port 80). HOT_CANADA.EXE is placed in a very obvious 'dialers' folder under Program Files. HOT_CANADA.EXE then begins execution. It contacts 204.177.92.204 (via HTTP/port 80) and proceeds to download HOT_CANADAUPDATE.EXE which is placed in the root directory of the PC. HOT_CANADAUPDATE.EXE then takes over with the most interesting activity and downloads HotOrgy_ca.exe and HardcoreVideos_ca.exe. They are placed in their own directories under the now infamous 'dialers' directory. Links are placed on the desktop and start menu to these new files. HOT_CANADA.EXE at this point seems to go into an idle state; the outbound traffic was minimal and consisted of HTTP requests. HOT_CANADA.EXE did examine the registry entries for RAS, long distance dialing codes, and analog modem devices. This looks like a genuine 'dialer' program. Although CANADA.EXE appeared to be 'compacted' with PECompact, there appeared to be no serious effort to hide or obfuscate what this program and its supporting executables do.

Alias

archive: Embedded EXE [Kaspersky], CANADA.EXE, Dialer [Name used by Ad-aware], Dialer.Gen [Panda], Generic Dialer [McAfee],

Origins

Author

John Herndon

Date of Origin

October, 2002

Detection and Removal

Manual Removal

Follow these steps to remove Hot Canada from your machine. Begin by backing up your registry and your system, and/or setting a Restore Point, to prevent trouble if you make a mistake.

Stop Running Processes:

Kill these running processes with Task Manager:

Remove Files:

Remove these files (if present) with Windows Explorer:

HoseCom404 HoseMocha HostileJava HostileThreads HotBar HotCanada HotasHell HotfixControl1.1.4 HotmailSpammer HotmailSpammerGEN3