W32/Mytob-DI

Please follow the instructions for removing worms.

Replace the Hosts file from a backup or edit it in Notepad to remove the changes that the worm has made.

You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

and remove any reference to any file you deleted.

Each user has a registry area named HKEY_USERS\[code number indicating user]\. For each user locate the entry:

HKU\[code number]\Software\Microsoft\Windows\
CurrentVersion\Run\

and remove any reference to any file you deleted.

Close the registry editor.

W32/Mytob-DI is a mass-mailing worm and IRC backdoor Trojan for the Windows platform.

W32/Mytob-DI runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

When first run W32/Mytob-DI copies itself to the Windows system folder as m0use.exe and creates the following registry entries:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Userinterface Report3r
m0use.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Userinterface Report3r
m0use.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Userinterface Report3r
m0use.exe

W32/Mytob-DI also changes the following registry entries:

from:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe

to:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe m0use.exe

The pathname of m0use.exe is also appended to the 'shell=' line in the [boot] section of <Windows>\System.ini, so that it is run on startup.

W32/Mytob-DI also disables certain system processes including the Windows XP firewall by changing the following default registry entry:

from:
HKLM\System\CurrentControlSet\Services\SharedAccess
Start
3

to:
HKLM\System\CurrentControlSet\Services\SharedAccess
Start
4

W32/Mytob-DI also includes functionality to silently download, install and run new software.

W32/Mytob-DI modifies the HOSTS file, changing the URL-to-IP mappings for selected websites, therefore preventing normal access to these sites. The new HOSTS file will typically contain the following:

127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 kaspersky-labs.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 pandasoftware.com
127.0.0.1 www.pandasoftware.com
127.0.0.1 www.trendmicro.com
127.0.0.1 www.grisoft.com
127.0.0.1 www.microsoft.com
127.0.0.1 microsoft.com
127.0.0.1 www.virustotal.com
127.0.0.1 virustotal.com
127.0.0.1 www.amazon.com
127.0.0.1 www.amazon.co.uk
127.0.0.1 www.amazon.ca
127.0.0.1 www.amazon.fr
127.0.0.1 www.paypal.com
127.0.0.1 paypal.com
127.0.0.1 moneybookers.com
127.0.0.1 www.moneybookers.com
127.0.0.1 www.ebay.com
127.0.0.1 ebay.com

W32/Mytob-DI is capable of spreading through email. Email sent by W32/Mytob-DI has the following properties:

Subject line chosen from:

'Notice of account limitation'
'Email Account Suspension'
'Security measures'
'Members Support'
'Important Notification'
'Warning Message: Your services near to be closed.'
'Your Account is Suspended For Security Reasons'
'*DETECTED* Online User Violation'
'Your Account is Suspended'
'Your new account password is approved'
'You have successfully updated your password'
'Your password has been successfully updated'
'Your password has been updated'
<random characters>

There is no message text enclosed within the email.

The attached file consists of any of the following base names followed by the extension ZIP:

'account-report'
'readme'
'account-info'
'email-details'
'account-details'
'important-details'
'accepted-password'
'account-password'
'approved-password'
'password'
'new-password'
'email-password'
'updated-password'
'document'
<random characters>

The worm may optionally create double extensions where the first extension is DOC, TXT or HTM and the final extension is PIF, SCR, EXE or ZIP.

W32/Mytob-DI harvests email addresses from files on the infected computer and from the Windows address book.