W32/Mytob.NM Worm

 Information about the W32/Mytob.NM Worm:

W32/Mytob.NM is a worm. This worm is a variant of W32/Mytob. The worm will infect Windows systems and spreads through email.

The infected email carries a spoofed 'From' address picked up randomly from the infected system.

The subject of the infected mail will be any one of the following;

Error
Good day
hello
Mail Delivery System
Mail Transaction Failed
Server Report
Status

The body of the infected mail will be any one of the following;

Here are your banks documents.
The original message was included as an attachment.
Mail transaction failed. Partial message is available.
The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.
The message contains Unicode characters and has been sent as a binary attachment.

The infected attachment will be any one of the following;

body
data
doc
document
file
message
readme
test
text

The extension of the infected attachment will be any one of the following;

bat, cmd, exe, pif, zip or scr.

Upon execution of the infected attachment, the worm copies itself as hot.exe in Windows System folder and funny_pic.scr, my_photo2005.scr and see_this!!.scr in the root drive.

The worm modifies registry at the following location to load itself during each startup.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

To propagate itself, the worm scans the files having the extensions wab and collects all the available email addresses from the infected system.

It also collects email addresses from the Temporary Internet Files folder.

The worm also has the backdoor capabilities. It connects to the Internet Relay Chat (IRC) server. After the connection is established, it joins an IRC channel and listens for commands coming from a remote user.

The worm also tries to terminate some of the security related processes and prevents access to some of the security related websites.

The worm also modifies the HOSTS file.

This worm first appeared on December 30, 2005.

 Other names of W32/Mytob.NM Worm:

This Worm is also known as WORM_MYTOB.NM.