W32/Mytob.ML Worm

 Information about the W32/Mytob.ML Worm:

W32/Mytob.ML is an email worm. This worm is a variant of W32/Mytob. The worm will infect Windows systems and spreads through email.

The infected email carries a spoofed 'From' address picked up randomly from the infected system.

The subject of the infected mail will be any one of the following;

Server Report
Mail Transaction Failed
Mail Delivery System

The body of the infected mail will be any one of the following;

Here are your banks documents.
Good day
+++ Attachment: No Virus (Clean)
hello

The infected attachment will be any one of the following;

readme
document
message

The extension of the infected attachment will be any one of the following;

bat, cmd, exe, pif, zip or scr.

Upon execution of the infected attachment, the worm copies itself as nethell.exe and taskgmr.exe in the Windows System folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

To propagate itself, the worm collects all the available email addresses from the Windows Address Book (WAB) of the infected system.

The worm mails itself to these addresses using its own SMTP engine.

The worm also has the backdoor capabilities. It connects to the Internet Relay Chat (IRC) server. After the connection is established, it joins an IRC channel and listens for commands coming from a remote malicious user.

It also modifies the HOSTS file.

The worm also tries to terminate some of the security related processes and prevents access to some of the security related websites.

This worm first appeared on November 14, 2005.

 Other names of W32/Mytob.ML Worm:

This Worm is also known as WORM_MYTOB.ML.