W32/Mytob-FX is a mass-mailing worm and IRC backdoor Trojan for the Windows platform.
W32/Mytob-FX may arrive as an attachment in an email with various characteristics.
W32/Mytob-FX runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.
W32/Mytob-FX attempts to terminate a large number of processes related to security and anti-virus programs.
W32/Mytob-FX also modifies the Windows hosts file in order to block access to websites.
W32/Mytob-FX is a mass-mailing worm and IRC backdoor Trojan for the Windows platform.
W32/Mytob-FX may arrive as an attachment in an email with various characteristics.
W32/Mytob-FX runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.
W32/Mytob-FX attempts to terminate a large number of processes related to security and anti-virus programs.
W32/Mytob-FX also modifies the Windows hosts file in order to block access to the following websites:
www.symantec.com
securityresponse.symantec.com
symantec.com
www.sophos.com
sophos.com
www.mcafee.com
mcafee.com
liveupdate.symantecliveupdate.com
www.viruslist.com
viruslist.com
viruslist.com
f-secure.com
www.f-secure.com
kaspersky.com
kaspersky-labs.com
www.avp.com
www.kaspersky.com
avp.com
www.networkassociates.com
networkassociates.com
www.ca.com
ca.com
mast.mcafee.com
my-etrust.com
www.my-etrust.com
download.mcafee.com
dispatch.mcafee.com
secure.nai.com
nai.com
www.nai.com
update.symantec.com
updates.symantec.com
us.mcafee.com
liveupdate.symantec.com
customer.symantec.com
rads.mcafee.com
trendmicro.com
pandasoftware.com
www.pandasoftware.com
www.trendmicro.com
www.grisoft.com
www.microsoft.com
microsoft.com
www.virustotal.com
virustotal.com
www.amazon.com
www.amazon.co.uk
www.amazon.ca
www.amazon.fr
www.paypal.com
paypal.com
moneybookers.com
www.moneybookers.com
www.ebay.com
ebay.com
When first run W32/Mytob-FX copies itself to <System>\msn32.exe.
The following registry entries are created to run msn32.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WINDOWS SYSTEM
msn32.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
WINDOWS SYSTEM
msn32.exe
W32/Mytob-FX sets the following registry entries, disabling the automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4
Note: disabling autostart for the SharedAccess service deactivates the Microsoft Internet Connection Firewall (ICF).