Toolbox

Download Experimental apps de telemóvel grátis Apps de desktop grátis

Win32.Worm.Mytob.GZ.dam

MÉDIO
MÉDIO
> 46,5 KB
(Net-Worm.Win32.Mytob.t, [email protected], W32/[email protected], W32/Mytob.G.worm, Worm W32/Mytob.GO)

Sintomas

 The presence of:
* the following 4 files having the same dimension:
    C:\FUNNY_PIC.SCR
    C:\MY_PHOTO2005.SCR
    C:\SEE_THIS!!.SCR
    %System%\JUSCHED32.EXE
* the file C:\HELLMSN.exe

and the inability to access security sites
    (due to the configuration of the hosts file %System%\DRIVERS\ETC\HOSTS)

Instruções para remoção:

Please let BitDefender disinfect your files.

Analisado por

Boeriu Laura, Virus Researcher

Descrição Técnica:

The malware copies itself to
     C:\FUNNY_PIC.SCR
     C:\MY_PHOTO2005.SCR
     C:\SEE_THIS!!.SCR
     %System%\JUSCHED32.EXE,

drops the backdoor C:\HELLMSN.exe (Backdoor.Faribot.A)

and sets the followings registry keys to "WINTASK DLL" = "jusched32.exe":
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\OLE
HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\Control\Lsa
These registry keys are continously recreated by the malware, making their deletion useless as long as the malware is active.

    Win32.Worm.Mytob.GZ.dam uses its own SMTP engine to spread by sending itself to e-mail adresses found in files on the infected computer.
 
    It searches the Windows Address Book files in:
%Windir%\Temporary Internet Files
%Userprofile%\Local Settings\Temporary Internet Files
%System%
and all the adb, tbb, dbx, asp, php, sht, htm, pl files found on the computer.

It does not send itself to adresses containing:
abuse                   accoun
acketst                  admin
anyone                  arin
avp                         bugs
ca                           certific
contact                  example
feste                      fido
foo.                        fsf.
gnu                       gold-certs
google                 help
info                       linux
listserv                 me
no                         nobody
noone                  not
nothing                ntivi
page                    postmaster
privacy                 rating
root                      samples
service                site
soft                      somebody
someone           submit
support               unix
webmaster        you
There are also some domain names that the malware does not send mail to
     (examples: .edu, .gov, .mil, ibm.com, ...)
The body of the infected mail contains one of the following messages:
* Mail transaction failed. Partial message is available.
* The message contains Unicode characters and has been sent as a binary attachment.
* The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.
* The original message was included as an attachment.
* Here are your banks documents.
The name of the attachment is composed by one of the words:
body
data
doc
document
file
message
readme
test
text
and one of the following extensions:
      cmd     bat     exe    scr    pif    zip


      Besides sending itself by e-mail messages, the malware peforms the following undesired actions:

* Loads an FTP server that listens on a random TCP port.
* Blocks the access to some security sites by adding to the %System%\DRIVERS\ETC\HOSTS file the following lines:
127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.microsoft.com
127.0.0.1 www.trendmicro.com
* Connects to an IRC channel and executes remote commands.