W32/Mytob.MU Worm

 Information about the W32/Mytob.MU Worm:

W32/Mytob.MU is a mass mailing worm. This worm is a variant of W32/Mytob.A. The worm will infect Windows systems and spreads through email.

The subject of the infected mail will be any one of the following;

Important Notification
Claim your free prize
Free Account Signup
Free Prize
Notice of prize winnings
Shipping Address Request (YourFreeiPod.com)
Claim Your Free 4GB iPod nano!
Retrive You Free iPod Nano!
Sending Free iPod measures
Winnings Claim
YourFreeiPod Support
Your Account is a winner
*IMPORTANT* Winnings notification

The body of the infected mail will be any one of the following;

Dear [name] Member,

Your e-mail account was picked from an online
site www.YourFreeiPod.com. Since we did pull
your name from the hat you are intitled to
receive FREE 4GB Black iPod Nano.
Please read the attachment in this email for
further instructions. If you choose to ignore
our request, you leave us no choice but to
forfeit your winnings.
Virtually yours,
The YourFreeiPod Team

+++ Attachment: No Virus found Scanned with Nod32
+++ [antivirus domain] Antivirus - www.[antivirus name].com

Dear [name] Member,

Please claim your free iPod Movie mediaplayer
Us here at YourFreeiPod.com like to treat our
members so we give away a free iPod every
month.
Attached to this email is the details on how
you can claim your prize
Sincerely,The YourFreeiPod Team

+++ Attachment: No Virus (Clean)
+++ [antivirus domain] Antivirus - www.[antivirus domain].com

Dear user [name],

You have been picked to receive a free prize!
Check the attachment in this email for claiming your prize.
Thank you
The YourFreeiPod Team

+++ Attachment: No Virus (Clean) +++ [antivirus domain] Antivirus - www.[antivirus name].com

Dear user [name],

It has come to our attention that your one of five winners
this month from YourFreeiPod.com
Please see the attachment in the email for further details.

Thank you for using YourFreeiPod.com!
The YourFreeiPod Team

+++ Attachment: No Virus (Clean)
+++ [antivirus domain] Antivirus - www.[antivirus name].com

The infected attachment will be any one of the following;

claim-prize
important-details
accept-terms
claim-infomation
details
readme
[random]
document
merchandise
shipping-details
terms
ship-prize
winner-details
winnings
winnings-report

The extension of the infected attachment will be single or double, The first extension can be any one of these;

doc, tmp, txt or htm.

The second extension can be any one of these;

bat, cmd, exe, pif, scr or zip.

Upon execution of the infected attachment, the worm copies itself as windbg32.exe in the Windows System folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

To propagate itself, the worm scans the files having the following extensions and collects all the available email addresses from the infected system.

adb, asp, cgi, dbx, htm, html, jsp, php, pl, sht, tbb, txt, wab and xml.

It also collects email addresses from the Temporary Internet Files folder.

The worm mails itself to these addresses using its own SMTP engine.

This worm first appeared on November 22, 2005.

 Other names of W32/Mytob.MU Worm:

This Worm is also known as WORM_MYTOB.MU.