WORM_MYTOB.HY

Malware type: Worm

Aliases: Net-Worm.Win32.Mytob.bi (Kaspersky), W32.Mytob.EE@mm (Symantec), Worm/Mytob.IM (Avira), W32/Mytob-DP (Sophos),

In the wild: Yes

Destructive: No

Language: English

Platform: Windows 95, 98, ME, NT, 2000, XP

Encrypted: No

Overall risk rating:

Reported infections:

Damage potential:

High

Distribution potential:

High

Description: 

Similar to other MYTOB variants, this memory-resident worm propagates by sending a copy of itself as an attachment to an email message, which it sends to target recipients using its own Simple Mail Transfer Protocol (SMTP) engine.

The email message it sends out has the following details:

Subject: (any of the following)
•*DETECTED* Online User Violation
•Email Account Suspension
•Important Notification
•Members Support
•Notice of account limitation
•Security measures
•Warning Message: Your services near to be closed.
•You have successfully updated your password
•Your Account is Suspended
•Your Account is Suspended For Security Reasons
•Your new account password is approved
•Your password has been successfully updated
•Your password has been updated

Message body: (any of the following)
===========

Dear user {name of recipient},
You have successfully updated the password of your {email account of user} account.
If you did not authorize this change or if you need assistance with your account, please contact {random customer service name} customer service at: {random contact number}
Thank you for using {random antivirus name}!
The {random name} Support Team
%20%20%20 Attachment: No Virus (Clean)

%20%20%20 {random antivirus name} Antivirus - www.{random antivirus Web site}

===========

Dear user {name of recipient},
It has come to our attention that your {domain} User Profile ( x ) records are out of date. For further details see the attached document.
Thank you for using {random name}!
The {random name} Support Team

%20%20%20 Attachment: No Virus (Clean)
%20%20%20 {random antivirus name} Antivirus - www.{random antivirus Web site}

===========

Dear {name of recipient} Member,
We have temporarily suspended your email account {email account of user}.
This might be due to either of the following reasons:
1. A recent change in your personal information (i.e. change of address).
2. Submiting invalid information during the initial sign up process.
3. An innability to accurately verify your selected option of subscription due to an internal error within our processors.
See the details to reactivate your {email account of user} account.
Sincerely,The {random name} Support Team

%20%20%20 Attachment: No Virus (Clean)

%20%20%20 {random antivirus name} Antivirus - www.{random antivirus Web site}

===========

Dear {name of recipient} Member,
Your e-mail account was used to send a huge amount of unsolicited spam messages during the recent week. If you could please take 5-10 minutes out of your online experience and confirm the attached document so you will not run into any future problems with the online service.
If you choose to ignore our request, you leave us no choice but to cancel your membership.
Virtually yours,
The {random name} Support Team

%20%20%20 Attachment: No Virus found
%20%20%20 {random antivirus name} Antivirus - www.{random antivirus Web site}

Attachment: (any combination of the following file names and extensions)

File name:
•accepted-password
•account-details
•account-info
•account-password
•account-report
•approved-password
•document
•email-details
•email-password
•important-details
•new-password
•password
•readme
•updated-password

Extension:
•BAT
•CMD
•EXE
•PIF
•SCR
•ZIP

It gathers target email addresses from the Windows Address Book (WAB). It may also generate email addresses by using a list of names and any of the domain names of the previously gathered addresses.

This worm has backdoor capabilities. It opens various ports, allowing a remote user to access and perform malicious commands on the affected machine. The said routine provides remote users virtual control over affected systems, thus compromising system security.

It prevents affected users from accessing several antivirus and security Web sites by modifying the HOSTS file. It also terminates several processes, most of which are related to antivirus and security programs.

For additional information about this threat, see:

Description created: Jul. 11, 2005 7:16:59 PM GMT -0800


TECHNICAL DETAILS


File type: PE

Memory resident:  Yes

Size of malware: 36,352 Bytes

Ports used: Varies

Initial samples received on: Jul 11, 2005

Compression type: PECompact

Payload 1: Terminates antivirus processes

Trigger condition 1: Upon execution

Payload 2: Modifies the HOSTS file

Trigger condition 1: Upon execution

Payload 3: Compromises system security

Trigger condition 1: Upon execution

Details:

Installation and Autostart Techniques

Upon execution, this memory-resident worm drops a copy of itself using the file name KASPERSKY.EXE in the Windows system folder.

It then creates the following registry entries to ensure its automatic execution at every Windows startup:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Run
Windows Messenger Service = "kaspersky.exe"

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\RunServices
Windows Messenger Service = "kaspersky.exe"

It also modifies the following registry entry to disable the Windows XP SP2 Firewall at startup:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\SharedAccess
Start = "dword:00000004"

(Note: The default value of this registry entry is "dword:00000003".)

Email Propagation

This worm propagates by sending a copy of itself as an attachment to email messages, which it sends to target addresses using its own Simple Mail Transfer Protocol (SMTP) engine.

The email message that it sends out has the following details:

Subject: (any of the following)
•*DETECTED* Online User Violation
•Email Account Suspension
•Important Notification
•Members Support
•Notice of account limitation
•Security measures
•Warning Message: Your services near to be closed.
•You have successfully updated your password
•Your Account is Suspended
•Your Account is Suspended For Security Reasons
•Your new account password is approved
•Your password has been successfully updated
•Your password has been updated

Message body: (any of the following)
===========

Dear user {name of recipient},
You have successfully updated the password of your {email account of user} account.
If you did not authorize this change or if you need assistance with your account, please contact {random customer service name} customer service at: {random contact number}
Thank you for using {random antivirus name}!
The {random name} Support Team
%20%20%20 Attachment: No Virus (Clean)

%20%20%20 {random antivirus name} Antivirus - www.{random antivirus Web site}

===========

Dear user {name of recipient},
It has come to our attention that your {domain} User Profile ( x ) records are out of date. For further details see the attached document.
Thank you for using {random name}!
The {random name} Support Team

%20%20%20 Attachment: No Virus (Clean)
%20%20%20 {random antivirus name} Antivirus - www.{random antivirus Web site}

===========

Dear {name of recipient} Member,
We have temporarily suspended your email account {email account of user}.
This might be due to either of the following reasons:
1. A recent change in your personal information (i.e. change of address).
2. Submiting invalid information during the initial sign up process.
3. An innability to accurately verify your selected option of subscription due to an internal error within our processors.
See the details to reactivate your {email account of user} account.
Sincerely,The {random name} Support Team

%20%20%20 Attachment: No Virus (Clean)

%20%20%20 {random antivirus name} Antivirus - www.{random antivirus Web site}

===========

Dear {name of recipient} Member,
Your e-mail account was used to send a huge amount of unsolicited spam messages during the recent week. If you could please take 5-10 minutes out of your online experience and confirm the attached document so you will not run into any future problems with the online service.
If you choose to ignore our request, you leave us no choice but to cancel your membership.
Virtually yours,
The {random name} Support Team

%20%20%20 Attachment: No Virus found
%20%20%20 {random antivirus name} Antivirus - www.{random antivirus Web site}

Attachment: (any combination of the following file names and extensions)

File name:
•accepted-password
•account-details
•account-info
•account-password
•account-report
•approved-password
•document
•email-details
•email-password
•important-details
•new-password
•password
•readme
•updated-password

Extension:
•BAT
•CMD
•EXE
•PIF
•SCR
•ZIP

It gathers target email addresses from the Windows Address Book (WAB). It may also generate email addresses by combining the following names with a domain name copied from previously harvested addresses:

  • andrew
  • brenda
  • brent
  • brian
  • claudia
  • david
  • debby
  • frank
  • george
  • helen
  • james
  • jerry
  • jimmy
  • julie
  • kevin
  • linda
  • maria
  • michael
  • michael
  • peter
  • robert
  • sales
  • sandra
  • smith
  • steve

It avoids sending email messages to addresses that contain any of the following substrings:

  • abuse
  • accoun
  • acketst
  • admin
  • admin
  • administrator
  • anyone
  • arin.
  • be_loyal:
  • berkeley
  • borlan
  • certific
  • contact
  • example
  • feste
  • gold-certs
  • google
  • google
  • hotmail
  • ibm.com
  • icrosof
  • icrosoft
  • inpris
  • isc.o
  • isi.e
  • kernel
  • linux
  • linux
  • listserv
  • mit.e
  • mozilla
  • mydomai
  • nobody
  • nodomai
  • noone
  • nothing
  • ntivi
  • panda
  • postmaster
  • privacy
  • rating
  • register
  • rfc-ed
  • ripe.
  • ruslis
  • samples
  • secur
  • secur
  • sendmail
  • service
  • service
  • somebody
  • someone
  • sopho
  • submit
  • support
  • support
  • tanford.e
  • the.bat
  • usenet
  • utgers.ed
  • webmaster
  • webmaster

This worm may spoof the From field of the email message that it sends using any of the email addresses it gathers or generates.

It queries the message exchange servers of the obtained email addresses by appending the domain names of the said email addresses to the following strings:

  • gate
  • mail
  • mail1
  • mx
  • mx1
  • mxs
  • ns
  • relay
  • smtp

Backdoor Routine

This worm has backdoor capabilities. It connects to the Internet Relay Chat (IRC) server hellinside.evilchat.net. It then joins a specific IRC channel, where it listens for commands coming from a remote malicious user. Some of these commands are as follows:

  • Download files
  • Execute files
  • Obtain this worm's version
  • Remove, update, or terminate itself

HOSTS File Modification

This worm also modifies the system's HOSTS file, which contains hostname to IP address mappings. The said file can be found in the %System%\drivers\etc folder.

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 95, 98, and ME, C:\WINNT\System32 on Windows NT and 2000, and C:\Windows\System32 on Windows XP.)

It appends a list of Web site addresses and directs the connection to the loopback address (127.0.0.1). The said routine is done so that the following sites, which are usually related to antivirus companies, can no longer be accessed by affected users:

  • avp.com
  • ca.com
  • customer.symantec.com
  • dispatch.mcafee.com
  • download.mcafee.com
  • ebay.com
  • f-secure.com
  • kaspersky.com
  • kaspersky-labs.com
  • liveupdate.symantec.com
  • liveupdate.symantecliveupdate.com
  • mast.mcafee.com
  • mcafee.com
  • microsoft.com
  • moneybookers.com
  • my-etrust.com
  • nai.com
  • networkassociates.com
  • pandasoftware.com
  • paypal.com
  • rads.mcafee.com
  • secure.nai.com
  • securityresponse.symantec.com
  • sophos.com
  • symantec.com
  • trendmicro.com
  • update.symantec.com
  • updates.symantec.com
  • us.mcafee.com
  • viruslist.com
  • viruslist.com
  • virustotal.com
  • www.amazon.ca
  • www.amazon.co.uk
  • www.amazon.com
  • www.amazon.fr
  • www.avp.com
  • www.ca.com
  • www.ebay.com
  • www.f-secure.com
  • www.grisoft.com
  • www.kaspersky.com
  • www.mcafee.com
  • www.microsoft.com
  • www.moneybookers.com
  • www.my-etrust.com
  • www.nai.com
  • www.networkassociates.com
  • www.pandasoftware.com
  • www.paypal.com
  • www.sophos.com
  • www.symantec.com
  • www.trendmicro.com
  • www.viruslist.com
  • www.virustotal.com

Process Termination

This worm terminates the following processes, most of which are related to antivirus and security programs:

  • _AVP32.EXE
  • _AVPCC.EXE
  • _AVPM.EXE
  • ACKWIN32.EXE
  • ADAWARE.EXE
  • ADVXDWIN.EXE
  • AGENTSVR.EXE
  • AGENTW.EXE
  • ALERTSVC.EXE
  • ALEVIR.EXE
  • ALOGSERV.EXE
  • AMON9X.EXE
  • ANTI-TROJAN.EXE
  • ANTIVIRUS.EXE
  • ANTS.EXE
  • APIMONITOR.EXE
  • APLICA32.EXE
  • APVXDWIN.EXE
  • ARR.EXE
  • ATCON.EXE
  • ATGUARD.EXE
  • ATRO55EN.EXE
  • ATUPDATER.EXE
  • ATUPDATER.EXE
  • ATWATCH.EXE
  • AU.EXE
  • AUPDATE.EXE
  • AUPDATE.EXE
  • AUTODOWN.EXE
  • AUTODOWN.EXE
  • AUTO-PROTECT.NAV80TRY.EX
  • AUTOTRACE.EXE
  • AUTOTRACE.EXE
  • AUTOUPDATE.EXE
  • AUTOUPDATE.EXE
  • AVCONSOL.EXE
  • AVE32.EXE
  • AVGCC32.EXE
  • AVGCTRL.EXE
  • AVGNT.EXE
  • AVGSERV.EXE
  • AVGSERV9.EXE
  • AVGUARD.EXE
  • AVGW.EXE
  • AVKPOP.EXE
  • AVKSERV.EXE
  • AVKSERVICE.EXE
  • AVKWCTl9.EXE
  • AVLTMAIN.EXE
  • AVNT.EXE
  • AVP.EXE
  • AVP32.EXE
  • AVPCC.EXE
  • AVPDOS32.EXE
  • AVPM.EXE
  • AVPTC32.EXE
  • AVPUPD.EXE
  • AVPUPD.EXE
  • AVSCHED32.EXE
  • AVSYNMGR.EXE
  • AVWINNT.EXE
  • AVWUPD.EXE
  • AVWUPD32.EXE
  • AVWUPD32.EXE
  • AVWUPSRV.EXE
  • AVXMONITOR9X.EXE
  • AVXMONITORNT.EXE
  • AVXQUAR.EXE
  • AVXQUAR.EXE
  • BACKWEB.EXE
  • BARGAINS.EXE
  • BD_PROFESSIONAL.EXE
  • BEAGLE.EXE
  • BELT.EXE
  • BIDEF.EXE
  • BIDSERVER.EXE
  • BIPCP.EXE
  • BIPCPEVALSETUP.EXE
  • BISP.EXE
  • BLACKD.EXE
  • BLACKICE.EXE
  • BLSS.EXE
  • BOOTCONF.EXE
  • BOOTWARN.EXE
  • BORG2.EXE
  • BPC.EXE
  • BRASIL.EXE
  • BS120.EXE
  • BUNDLE.EXE
  • BVT.EXE
  • C.EXE
  • CCAPP.EXE
  • CCEVTMGR.EXE
  • CCPXYSVC.EXE
  • CDP.EXE
  • CFD.EXE
  • CFGWIZ.EXE
  • CFIADMIN.EXE
  • CFIAUDIT.EXE
  • CFIAUDIT.EXE
  • CFINET.EXE
  • CFINET32.EXE
  • CLAW95CF.EXE
  • CLEAN.EXE
  • CLEANER.EXE
  • CLEANER3.EXE
  • CLEANPC.EXE
  • CLICK.EXE
  • CMD.EXE
  • CMD32.EXE
  • CMESYS.EXE
  • CMGRDIAN.EXE
  • CMON016.EXE
  • CONNECTIONMONITOR.EXE
  • CPD.EXE
  • CPF9X206.EXE
  • CPFNT206.EXE
  • CTRL.EXE
  • CV.EXE
  • CWNB181.EXE
  • CWNTDWMO.EXE
  • DATEMANAGER.EXE
  • DCOMX.EXE
  • DEFALERT.EXE
  • DEFSCANGUI.EXE
  • DEFWATCH.EXE
  • DEPUTY.EXE
  • DIVX.EXE
  • DLLCACHE.EXE
  • DLLREG.EXE
  • DOORS.EXE
  • DPF.EXE
  • DPFSETUP.EXE
  • DPPS2.EXE
  • DRWATSON.EXE
  • DRWEB32.EXE
  • DRWEBUPW.EXE
  • DSSAGENT.EXE
  • DVP95.EXE
  • DVP95_0.EXE
  • ECENGINE.EXE
  • EFPEADM.EXE
  • EMSW.EXE
  • ENT.EXE
  • ESAFE.EXE
  • ESCANHNT.EXE
  • ESCANV95.EXE
  • ESPWATCH.EXE
  • ETHEREAL.EXE
  • ETRUSTCIPE.EXE
  • EVPN.EXE
  • EXANTIVIRUS-CNET.EXE
  • EXE.AVXW.EXE
  • EXPERT.EXE
  • EXPLORE.EXE
  • FAMEH32.EXE
  • FAST.EXE
  • FCH32.EXE
  • FIH32.EXE
  • FINDVIRU.EXE
  • FIREWALL.EXE
  • FNRB32.EXE
  • FPROT.EXE
  • F-PROT.EXE
  • F-PROT95.EXE
  • FP-WIN.EXE
  • FP-WIN_TRIAL.EXE
  • FRW.EXE
  • FSAA.EXE
  • FSAV.EXE
  • FSAV32.EXE
  • FSAV530STBYB.EXE
  • FSAV530WTBYB.EXE
  • FSAV95.EXE
  • FSGK32.EXE
  • FSM32.EXE
  • FSMA32.EXE
  • FSMB32.EXE
  • F-STOPW.EXE
  • GATOR.EXE
  • GBMENU.EXE
  • GBPOLL.EXE
  • GENERICS.EXE
  • GMT.EXE
  • GUARD.EXE
  • GUARDDOG.EXE
  • HACKTRACERSETUP.EXE
  • HBINST.EXE
  • HBSRV.EXE
  • HOTACTIO.EXE
  • HOTPATCH.EXE
  • HTLOG.EXE
  • HTPATCH.EXE
  • HWPE.EXE
  • HXDL.EXE
  • HXIUL.EXE
  • IAMAPP.EXE
  • IAMSERV.EXE
  • IAMSTATS.EXE
  • IBMASN.EXE
  • IBMAVSP.EXE
  • ICLOADNT.EXE
  • ICMON.EXE
  • ICSUPP95.EXE
  • ICSUPPNT.EXE
  • IDLE.EXE
  • IEDLL.EXE
  • IEDRIVER.EXE
  • IEXPLORER.EXE
  • IFACE.EXE
  • IFW2000.EXE
  • INETLNFO.EXE
  • INFUS.EXE
  • INFWIN.EXE
  • INIT.EXE
  • INTDEL.EXE
  • INTREN.EXE
  • IOMON98.EXE
  • ISTSVC.EXE
  • JAMMER.EXE
  • JDBGMRG.EXE
  • JEDI.EXE
  • KAVLITE40ENG.EXE
  • KAVPERS40ENG.EXE
  • KAVPF.EXE
  • KAZZA.EXE
  • KEENVALUE.EXE
  • KERIO-PF-213-EN-WIN.EXE
  • KERIO-WRL-421-EN-WIN.EXE
  • KERIO-WRP-421-EN-WIN.EXE
  • KERNEL32.EXE
  • KILLPROCESSSETUP161.EXE
  • LAUNCHER.EXE
  • LDNETMON.EXE
  • LDPRO.EXE
  • LDPROMENU.EXE
  • LDSCAN.EXE
  • LNETINFO.EXE
  • LOADER.EXE
  • LOCALNET.EXE
  • LOCKDOWN.EXE
  • LOCKDOWN2000.EXE
  • LOOKOUT.EXE
  • LORDPE.EXE
  • LSETUP.EXE
  • LUALL.EXE
  • LUALL.EXE
  • LUAU.EXE
  • LUCOMSERVER.EXE
  • LUINIT.EXE
  • LUSPT.EXE
  • MAPISVC32.EXE
  • MCAGENT.EXE
  • MCMNHDLR.EXE
  • MCSHIELD.EXE
  • MCTOOL.EXE
  • MCUPDATE.EXE
  • MCUPDATE.EXE
  • MCVSRTE.EXE
  • MCVSSHLD.EXE
  • MD.EXE
  • MFIN32.EXE
  • MFW2EN.EXE
  • MFWENG3.02D30.EXE
  • MGAVRTCL.EXE
  • MGAVRTE.EXE
  • MGHTML.EXE
  • MGUI.EXE
  • MINILOG.EXE
  • MMOD.EXE
  • MONITOR.EXE
  • MOOLIVE.EXE
  • MOSTAT.EXE
  • MPFAGENT.EXE
  • MPFSERVICE.EXE
  • MPFTRAY.EXE
  • MRFLUX.EXE
  • MSAPP.EXE
  • MSBB.EXE
  • MSBLAST.EXE
  • MSCACHE.EXE
  • MSCCN32.EXE
  • MSCMAN.EXE
  • MSCONFIG.EXE
  • MSDM.EXE
  • MSDOS.EXE
  • MSIEXEC16.EXE
  • MSINFO32.EXE
  • MSLAUGH.EXE
  • MSMGT.EXE
  • MSMSGRI32.EXE
  • MSSMMC32.EXE
  • MSSYS.EXE
  • MSVXD.EXE
  • MU0311AD.EXE
  • MWATCH.EXE
  • N32SCANW.EXE
  • NAV.EXE
  • NAVAP.NAVAPSVC.EXE
  • NAVAPSVC.EXE
  • NAVAPW32.EXE
  • NAVDX.EXE
  • NAVLU32.EXE
  • NAVNT.EXE
  • NAVSTUB.EXE
  • NAVW32.EXE
  • NAVWNT.EXE
  • NC2000.EXE
  • NCINST4.EXE
  • NDD32.EXE
  • NEOMONITOR.EXE
  • NEOWATCHLOG.EXE
  • NETARMOR.EXE
  • NETD32.EXE
  • NETINFO.EXE
  • NETMON.EXE
  • NETSCANPRO.EXE
  • NETSPYHUNTER-1.2.EXE
  • NETSTAT.EXE
  • NETUTILS.EXE
  • NISSERV.EXE
  • NISUM.EXE
  • NMAIN.EXE
  • NOD32.EXE
  • NORMIST.EXE
  • NORTON_INTERNET_SECU_3.0
  • NOTSTART.EXE
  • NPF40_TW_98_NT_ME_2K.EXE
  • NPFMESSENGER.EXE
  • NPROTECT.EXE
  • NPSCHECK.EXE
  • NPSSVC.EXE
  • NSCHED32.EXE
  • NSSYS32.EXE
  • NSTASK32.EXE
  • NSUPDATE.EXE
  • NT.EXE
  • NTRTSCAN.EXE
  • NTVDM.EXE
  • NTXconfig.EXE
  • NUI.EXE
  • NUPGRADE.EXE
  • NUPGRADE.EXE
  • NVARCH16.EXE
  • NVC95.EXE
  • NVSVC32.EXE
  • NWINST4.EXE
  • NWSERVICE.EXE
  • NWTOOL16.EXE
  • OLLYDBG.EXE
  • ONSRVR.EXE
  • OPTIMIZE.EXE
  • OSTRONET.EXE
  • OTFIX.EXE
  • OUTPOST.EXE
  • OUTPOST.EXE
  • OUTPOSTINSTALL.EXE
  • OUTPOSTPROINSTALL.EXE
  • PADMIN.EXE
  • PANIXK.EXE
  • PATCH.EXE
  • PAVCL.EXE
  • PAVPROXY.EXE
  • PAVSCHED.EXE
  • PAVW.EXE
  • PCFWALLICON.EXE
  • PCIP10117_0.EXE
  • PCSCAN.EXE
  • PDSETUP.EXE
  • PERISCOPE.EXE
  • PERSFW.EXE
  • PERSWF.EXE
  • PF2.EXE
  • PFWADMIN.EXE
  • PGMONITR.EXE
  • PINGSCAN.EXE
  • PLATIN.EXE
  • POP3TRAP.EXE
  • POPROXY.EXE
  • POPSCAN.EXE
  • PORTDETECTIVE.EXE
  • PORTMONITOR.EXE
  • POWERSCAN.EXE
  • PPINUPDT.EXE
  • PPTBC.EXE
  • PPVSTOP.EXE
  • PRIZESURFER.EXE
  • PRMT.EXE
  • PRMVR.EXE
  • PROCDUMP.EXE
  • PROCESSMONITOR.EXE
  • PROCEXPLORERV1.0.EXE
  • PROGRAMAUDITOR.EXE
  • PROPORT.EXE
  • PROTECTX.EXE
  • PSPF.EXE
  • PURGE.EXE
  • QCONSOLE.EXE
  • QSERVER.EXE
  • RAPAPP.EXE
  • RAV7.EXE
  • RAV7WIN.EXE
  • RAV8WIN32ENG.EXE
  • RAY.EXE
  • RB32.EXE
  • RCSYNC.EXE
  • REALMON.EXE
  • REGED.EXE
  • REGEDIT.EXE
  • REGEDT32.EXE
  • RESCUE.EXE
  • RESCUE32.EXE
  • RRGUARD.EXE
  • RSHELL.EXE
  • RTVSCAN.EXE
  • RTVSCN95.EXE
  • RULAUNCH.EXE
  • RUN32DLL.EXE
  • RUNDLL.EXE
  • RUNDLL16.EXE
  • RUXDLL32.EXE
  • SAFEWEB.EXE
  • SAHAGENT.EXE
  • SAVE.EXE
  • SAVENOW.EXE
  • SBSERV.EXE
  • SC.EXE
  • SCAM32.EXE
  • SCAN32.EXE
  • SCAN95.EXE
  • SCANPM.EXE
  • SCRSCAN.EXE
  • SETUP_FLOWPROTECTOR_US.E
  • SETUPVAMEEVAL.EXE
  • SFC.EXE
  • SGSSFW32.EXE
  • SH.EXE
  • SHELLSPYINSTALL.EXE
  • SHN.EXE
  • SHOWBEHIND.EXE
  • SMC.EXE
  • SMS.EXE
  • SMSS32.EXE
  • SOAP.EXE
  • SOFI.EXE
  • SPERM.EXE
  • SPF.EXE
  • SPHINX.EXE
  • SPOLER.EXE
  • SPOOLCV.EXE
  • SPOOLSV32.EXE
  • SPYXX.EXE
  • SREXE.EXE
  • SRNG.EXE
  • SS3EDIT.EXE
  • SSG_4104.EXE
  • SSGRATE.EXE
  • ST2.EXE
  • START.EXE
  • STCLOADER.EXE
  • SUPFTRL.EXE
  • SUPPORT.EXE
  • SUPPORTER5.EXE
  • SVC.EXE
  • SVCHOSTC.EXE
  • SVCHOSTS.EXE
  • SVSHOST.EXE
  • SWEEP95.EXE
  • SWEEPNET.SWEEPSRV.SYS.SW
  • SYMPROXYSVC.EXE
  • SYMTRAY.EXE
  • SYSEDIT.EXE
  • SYSTEM.EXE
  • SYSTEM32.EXE
  • SYSUPD.EXE
  • TASKMG.EXE
  • TASKMGR.EXE
  • TASKMO.EXE
  • TASKMON.EXE
  • TAUMON.EXE
  • TBSCAN.EXE
  • TC.EXE
  • TCA.EXE
  • TCM.EXE
  • TDS2-NT.EXE
  • TDS-3.EXE
  • TEEKIDS.EXE
  • TFAK.EXE
  • TFAK5.EXE
  • TGBOB.EXE
  • TITANIN.EXE
  • TITANINXP.EXE
  • TRACERT.EXE
  • TRICKLER.EXE
  • TRJSCAN.EXE
  • TRJSETUP.EXE
  • TROJANTRAP3.EXE
  • TSADBOT.EXE
  • TVMD.EXE
  • TVTMD.EXE
  • UNDOBOOT.EXE
  • UPDAT.EXE
  • UPDATE.EXE
  • UPDATE.EXE
  • UPGRAD.EXE
  • UTPOST.EXE
  • VBCMSERV.EXE
  • VBCONS.EXE
  • VBUST.EXE
  • VBWIN9X.EXE
  • VBWINNTW.EXE
  • VCSETUP.EXE
  • VET32.EXE
  • VET95.EXE
  • VETTRAY.EXE
  • VFSETUP.EXE
  • VIR-HELP.EXE
  • VIRUSMDPERSONALFIREWALL.
  • VNLAN300.EXE
  • VNPC3000.EXE
  • VPC32.EXE
  • VPC42.EXE
  • VPFW30S.EXE
  • VPTRAY.EXE
  • VSCAN40.EXE
  • VSCENU6.02D30.EXE
  • VSCHED.EXE
  • VSECOMR.EXE
  • VSHWIN32.EXE
  • VSISETUP.EXE
  • VSMAIN.EXE
  • VSMON.EXE
  • VSSTAT.EXE
  • VSWIN9XE.EXE
  • VSWINNTSE.EXE
  • VSWINPERSE.EXE
  • W32DSM89.EXE
  • W9X.EXE
  • WATCHDOG.EXE
  • WEBDAV.EXE
  • WEBSCANX.EXE
  • WEBTRAP.EXE
  • WFINDV32.EXE
  • WHOSWATCHINGME.EXE
  • WIMMUN32.EXE
  • WIN32.EXE
  • WIN32US.EXE
  • WINACTIVE.EXE
  • WIN-BUGSFIX.EXE
  • WINDOW.EXE
  • WINDOWS.EXE
  • WININETD.EXE
  • WININIT.EXE
  • WININITX.EXE
  • WINLOGIN.EXE
  • WINMAIN.EXE
  • WINNET.EXE
  • WINPPR32.EXE
  • WINRECON.EXE
  • WINSERVN.EXE
  • WINSSK32.EXE
  • WINSTART.EXE
  • WINSTART001.EXE
  • WINTSK32.EXE
  • WINUPDATE.EXE
  • WKUFIND.EXE
  • WNAD.EXE
  • WNT.EXE
  • WRADMIN.EXE
  • WRCTRL.EXE
  • WSBGATE.EXE
  • WUPDATER.EXE
  • WUPDT.EXE
  • WYVERNWORKSFIREWALL.EXE
  • XPF202EN.EXE
  • ZAPRO.EXE
  • ZAPSETUP3001.EXE
  • ZATUTOR.EXE
  • ZONALM2601.EXE
  • ZONEALARM.EXE

Other Details

This worm runs on Windows 95, 98, ME, NT, 2000, and XP.

Analysis By: Raymond Richard Bautista Gamboa

Revision History:

 
Jul 14, 2005 - Modified Virus Report

SOLUTION


Minimum scan engine version needed: 6.810

Pattern file needed: 2.724.03

Pattern release date: Jul 12, 2005


Important note: The "Minimum scan engine" refers to the earliest Trend Micro scan engine version guaranteed to detect this threat. However, Trend Micro strongly recommends that you update to the latest version in order to get comprehensive protection. Download the latest scan engine here.

Solution:

Restarting in Safe Mode

On Windows 95

  1. Restart your computer.
  2. Press F8 at the Starting Windows 95 message.
  3. Choose Safe Mode from the Windows 95 Startup Menu then press Enter.

On Windows 98 and ME

  1. Restart your computer.
  2. Press the CTRL key until the startup menu appears.
  3. Choose the Safe Mode option then press Enter.

On Windows NT (VGA mode)

  1. Click Start>Settings>Control Panel.
  2. Double-click the System icon.
  3. Click the Startup/Shutdown tab.
  4. Set the Show List field to 10 seconds and click OK to save this change.
  5. Shut down and restart your computer.
  6. Select VGA mode from the startup menu.

On Windows 2000

  1. Restart your computer.
  2. Press the F8 key, when you see the Starting Windows bar at the bottom of the screen.
  3. Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter.

On Windows XP

  1. Restart your computer.
  2. Press F8 after the Power-On Self Test (POST) is done. If the Windows Advanced Options Menu does not appear, try restarting and then pressing F8 several times after the POST screen.
  3. Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter.

Note: After performing all the solutions for the removal of this malware, please restart your system normally, and run your Trend Micro antivirus product.

Editing the Registry

This malware modifies the system's registry. Users affected by this malware may need to modify or delete specific registry keys or entries. For detailed information regarding registry editing, please refer to the following articles from Microsoft:

  1. HOW TO: Backup, Edit, and Restore the Registry in Windows 95, Windows 98, and Windows ME
  2. HOW TO: Backup, Edit, and Restore the Registry in Windows NT 4.0
  3. HOW TO: Backup, Edit, and Restore the Registry in Windows 2000
  4. HOW TO: Backup, Edit, and Restore the Registry in Windows XP

Removing Autostart Entries from the Registry

Removing autostart entries from the registry prevents the malware from executing at startup.

If the registry entries below are not found, the malware may not have executed as of detection. If so, proceed to the succeeding solution set.

  1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
  2. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Microsoft>
    Windows>CurrentVersion>Run
  3. In the right panel, locate and delete the entry:
    Windows Messenger Service = "kaspersky.exe"
  4. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Microsoft>
    Windows>CurrentVersion>RunServices
  5. In the right panel, locate and delete the entry:
    Windows Messenger Service = "kaspersky.exe"

Restoring Modified Entries from the Registry

  1. Still in the Registry Editor, in the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>System>CurrentControlSet>
    Services>SharedAccess
  2. In the right panel, locate the entry:
    Start = "dword:00000004"
  3. Right-click on this registry entry and choose Modify. Change the value of this entry to:
    Start = "dword:00000003"
  4. Close Registry Editor.

Removing Malware Entries from the HOSTS File

Deleting malware entries from the HOSTS file removes all malware-made changes on host name association.

  1. Open the following file using a text editor (such as NOTEPAD):
      %System%\drivers\etc\HOSTS
    (Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 95, 98, and ME, C:\WINNT\System32 on Windows NT and 2000, and C:\Windows\System32 on Windows XP.)
  2. Delete the following entries:
    • 127.0.0.1 www.symantec.com
    • 127.0.0.1 securityresponse.symantec.com
    • 127.0.0.1 symantec.com
    • 127.0.0.1 www.sophos.com
    • 127.0.0.1 sophos.com
    • 127.0.0.1 www.mcafee.com
    • 127.0.0.1 mcafee.com
    • 127.0.0.1 liveupdate.symantecliveupdate.com
    • 127.0.0.1 www.viruslist.com
    • 127.0.0.1 viruslist.com
    • 127.0.0.1 viruslist.com
    • 127.0.0.1 f-secure.com
    • 127.0.0.1 www.f-secure.com
    • 127.0.0.1 kaspersky.com
    • 127.0.0.1 kaspersky-labs.com
    • 127.0.0.1 www.avp.com
    • 127.0.0.1 www.kaspersky.com
    • 127.0.0.1 avp.com
    • 127.0.0.1 www.networkassociates.com
    • 127.0.0.1 networkassociates.com
    • 127.0.0.1 www.ca.com
    • 127.0.0.1 ca.com
    • 127.0.0.1 mast.mcafee.com
    • 127.0.0.1 my-etrust.com
    • 127.0.0.1 www.my-etrust.com
    • 127.0.0.1 download.mcafee.com
    • 127.0.0.1 dispatch.mcafee.com
    • 127.0.0.1 secure.nai.com
    • 127.0.0.1 nai.com
    • 127.0.0.1 www.nai.com
    • 127.0.0.1 update.symantec.com
    • 127.0.0.1 updates.symantec.com
    • 127.0.0.1 us.mcafee.com
    • 127.0.0.1 liveupdate.symantec.com
    • 127.0.0.1 customer.symantec.com
    • 127.0.0.1 rads.mcafee.com
    • 127.0.0.1 trendmicro.com
    • 127.0.0.1 pandasoftware.com
    • 127.0.0.1 www.pandasoftware.com
    • 127.0.0.1 www.trendmicro.com
    • 127.0.0.1 www.grisoft.com
    • 127.0.0.1 www.microsoft.com
    • 127.0.0.1 microsoft.com
    • 127.0.0.1 www.virustotal.com
    • 127.0.0.1 virustotal.com
    • 127.0.0.1 www.amazon.com
    • 127.0.0.1 www.amazon.co.uk
    • 127.0.0.1 www.amazon.ca
    • 127.0.0.1 www.amazon.fr
    • 127.0.0.1 www.paypal.com
    • 127.0.0.1 paypal.com
    • 127.0.0.1 moneybookers.com
    • 127.0.0.1 www.moneybookers.com
    • 127.0.0.1 www.ebay.com
    • 127.0.0.1 ebay.com
  3. Save the file and close the text editor.

Important Windows ME/XP Cleaning Instructions

Users running Windows ME and XP must disable System Restore to allow full scanning of infected systems.

Users running other Windows versions can proceed with the succeeding procedure set(s).

Running Trend Micro Antivirus

Scan your system with Trend Micro antivirus and delete files detected as WORM_MYTOB.HY. To do this, Trend Micro customers must download the latest pattern file and scan their system. Other Internet users can use HouseCall, Trend Micro's online virus scanner.




Trend Micro offers best-of-breed antivirus and content-security solutions for your corporate network, small and medium business, mobile device or home PC.