[virusinfo] W32/Mytob-B
- From: "Mike" <mikebike@xxxxxxxxx>
- To: virusinfo@xxxxxxxxxxxxx
- Date: Tue, 15 Mar 2005 13:59:06 -0800
From; Sophos Alert System:
Name: W32/Mytob-B
Type: Win32 worm
Date: 15 March 2005
A virus identity (IDE) file which provides protection is
available now from the Sophos website, and will be incorporated
into the May 2005 (3.93) release of Sophos Anti-Virus.
Customers using EM Library, PureMessage or any of our Sophos
small business solutions will be automatically protected at
their next scheduled update.
At the time of writing, Sophos has received a small number of
reports of this worm from the wild.
Information about W32/Mytob-B can be found at:
http://www.sophos.com/virusinfo/analyses/w32mytobb.html
W32/Mytob-B is a mass-mailing network worm with backdoor functionality that
targets users of Internet Relay Chat programs.
W32/Mytob-B attempts to harvest email addresses from the infected system.
Emails sent by W32/Mytob-B have the following characteristics.
The subject line is one of the following:
Error
Status
Server Report
Mail Transaction Failed
Mail Delivery System
hello
hi
The message text is one of the following lines:
This is a multi-part message in MIME format.
Mail transaction failed. Partial message is available.
The message contains Unicode characters and has been sent as a binary
attachment.
The message cannot be represented in 7-bit ASCII encoding and has been sent as
a binary attachment.
The original message was included as an attachment.
Here are your banks documents.
The worm is included as an attachment to the message, either as an executable
file (with CMD, BAT, EXE or COM extension) or as a ZIP file containing the
executable. The filename (excluding file extension) is chosen from the
following list:
BODY
DATA
DOC
DOCUMENT
FILE
MESSAGE
README
TEST
TEXT
When first run W32/Mytob-B copies itself to the Windows system folder as
TASKGMR.EXE and creates the following registry entries in order to run itself
on startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
WINTASK
taskgmr.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
WINTASK
taskgmr.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
WINTASK
taskgmr.exe
W32/Mytob-B makes the following additional changes to the system registry:
HKCU\SYSTEM\CurrentControlSet\Control\Lsa
WINTASK
taskgmr.exe
HKCU\Software\Microsoft\OLE
WINTASK
taskgmr.exe
HKLM\SOFTWARE\Microsoft\Ole
WINTASK
taskgmr.exe
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
WINTASK
taskgmr.exe
W32/Mytob-B modifies the system HOSTS file in order to prevent access to the
following web addresses:
avp.com
ca.com
customer.symantec.com
dispatch.mcafee.com
download.mcafee.com
f-secure.com
kaspersky.com
liveupdate.symantec.com
liveupdate.symantecliveupdate.com
mast.mcafee.com
mcafee.com
my-etrust.com
nai.com
networkassociates.com
rads.mcafee.com
secure.nai.com
securityresponse.symantec.com
sophos.com
symantec.com
trendmicro.com
update.symantec.com
updates.symantec.com
us.mcafee.com
viruslist.com
viruslist.com
www.avp.com
www.ca.com
www.f-secure.com
www.kaspersky.com
www.mcafee.com
www.microsoft.com
www.my-etrust.com
www.nai.com
www.networkassociates.com
www.sophos.com
www.symantec.com
www.trendmicro.com
www.viruslist.com
This IDE file also includes detection for:
Troj/Dloader-JH
http://www.sophos.com/virusinfo/analyses/trojdloaderjh.html
Troj/Psyme-BN
http://www.sophos.com/virusinfo/analyses/trojpsymebn.html
W32/Rbot-YA
http://www.sophos.com/virusinfo/analyses/w32rbotya.html
W32/Rbot-YC
http://www.sophos.com/virusinfo/analyses/w32rbotyc.html
Download the IDE file from:
http://www.sophos.com/downloads/ide/mytob-b.ide
Download all the IDE files available for the current version of
Sophos Anti-Virus in a single compressed file. The file is
available in two formats:
Zip file:
http://www.sophos.com/downloads/ide/ides.zip
Self-extracting file:
http://www.sophos.com/downloads/ide/ides.exe
Read about how to use IDE files at
http://www.sophos.com/downloads/ide/using.html
*********** MIKE"S REPLY SEPARATOR ***********
Mike ~ It is a good day if I learned something new.
Editor MikesWhatsNews see a sample on my web page
http://www3.telus.net/mikebike
<mikeswhatsnews-request@xxxxxxxxxxxxx?Subject=subscribe>
http://www3.telus.net/mikebike/worm_removal.htm
See my Anti-Virus pages http://virusinfo.hackfix.org/index
<virusinfo-request@xxxxxxxxxxxxx?Subject=subscribe>
A Technical Support Alliance and OWTA Charter Member
Other related posts:
