W32/Mytob-A

Please follow the instructions for removing worms.

You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

and remove any reference to any file you deleted.

Each user has a registry area named HKEY_USERS\[code number indicating user]\. For each user locate the entry:

HKU\[code number]\Software\Microsoft\Windows\
CurrentVersion\Run\

and remove any reference to any file you deleted.

Close the registry editor.

W32/Mytob-A is a mass-mailing network worm and backdoor trojan that targets users of Internet Relay Chat programs.

Upon execution W32/Mytob-A will copy itself to the default System folder as the file msnmsgr.exe.

W32/Mytob-A will use its own SMTP engine to send itself to email addresses harvested from the victims computer but will avoid addresses containing certain strings.

W32/Mytob-A will open an IRC channel called yakuza for incoming commands from a remote attacker and may also open backdoor TCP connections. W32/Mytob-A is a mass-mailing network worm and backdoor trojan that targets users of Internet Relay Chat programs.

Upon execution W32/Mytob-A will copy itself to the default System folder as the file msnmsgr.exe and will create the following registry entries:

HKCU\System\CurrentControlSet\Control\Lsa\
MSN
msnmsgr.exe

HKCU\Software\Microsoft\OLE\
MSN
msnmsgr.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
MSN
msnmsgr.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
MSN
msnmsgr.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
MSN
msnmsgr.exe

W32/Mytob-A will use its own SMTP engine to send itself to email addresses harvested from the victim's computer but will avoid addresses containing certain strings. Emails sent by W32/Mytob-A will have the following characteristics:

From: The from address will be Spoofed by W32/Mytob-A

Subject:

"Hi",
"Hello",
"Error",
"test",
"Mail Transaction Failed",
"Status",
"Mail Delivery System",
"Server Report",
Random text

Body Text:

"Mail transaction failed. Partial message is available.",
"The message contains Unicode characters and has been sent as a binary
attachment.",
"The message cannot be represented in 7-bit ASCII encodingand has been sent as
a binary attachment.",
"test",
No body text,
Random characters.

Attachment name:

test,
text,
body,
readme,
doc,
document,
data,
file,
message,
random characters,

Possible attachment extensions,

pif,
scr,
zip,
cmd,
exe.

If the attachment is a zip archive the archived file may have a double
extension, for example 'readme.htm .exe'.

W32/Mytob-A will open an IRC channel called yakuza for incoming commands from a remote attacker and may also open backdoor TCP connections.