W32/Mytob.FK Worm

 Information about the W32/Mytob.FK Worm:

W32/Mytob.FK is a mass mailing worm. This worm is a variant of W32/Mytob.A. The worm will infect Windows systems and spreads through email.

The subject of the infected mail will be any one of the following;

Account Alert
Security measures
Important Notification
Notice: **Last Warning**
Email Account Suspension
Notice of account limitation
*DETECTED* Online User Violation
*WARNING* Your Email Account Will Be Closed
Your Email Account is Suspended For Security Reasons

The body of the infected mail will be any one of the following;

The original message has been included as an attachment.
Please read the attached document and follow it's instructions.
We attached some important information regarding your account.
We regret to inform you that your account has been suspended due to the violation of our site policy, more info is attached.
Once you have completed the form in the attached file , your account records will not be interrupted and will continue as normal.

The infected attachment will be any one of the following;

info-text
email-info
document
email-doc
information
information
instructions
account-details

The extension of the infected attachment will be any one of the following;

bat, cmd, exe, pif, scr or zip

Upon execution of the infected attachment, the worm copies itself as wID32.exe in the Windows System folder.

The worm modifies registry at the following location to load itself during each startup

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

To propagate itself, the worm collects all the available email addresses from the Windows Address Book (WAB) of the infected system.

It also modifies the HOSTS file.

The worm also tries to terminate some of the security related processes and prevents access to some of the security related websites

This worm first appeared on November 11, 2005.

 Other names of W32/Mytob.FK Worm:

This Worm is also known as Net-Worm.Win32.Mytob.de, WORM_MYTOB.MH.