W32/Dumaru.Y Worm

 Information about the W32/Dumaru.Y Worm:

W32/Dumaru.Y is a mass mailing worm. It spreads using the email addresses present in the infected system. It also contains a backdoor trojan component that contains key-logging capability.

It arrives with the following subject:

Subject: Important information for you. Read it immediately !

The body of the infected mail will be:

Hi !
Here is my photo, that you asked for yesterday.

The infected mail carries an attachment myphoto.zip. The zip file contains an executable called myphoto.jpg.exe.

When the infected attachment is executed, the worm copies itself as l32x.exe and vxd32v.exe under the Windows System folder and rundllx.sys under Windows folder. It also copies dllxw.exe under Windows Startup folder.

It alters the windows registry at the following location to load itself during next startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The worm scans the following extensions and collects the available email addresses from the infected system.

.wab .tbb .html .htm .dbx .abd

The worm uses its own SMTP engine to propagate itself to all these addresses.

This worm first appeared on 24th January 2004.

 Other names of W32/Dumaru.Y Worm:

This worm is also known as W32.Dumaru.Y@mm, W32/Dumaru.y@MM, W32/Dumaru-Y