W32/Mytob-DK

Please follow the instructions for removing worms.

W32/Mytob-DK is a mass-mailing worm and IRC backdoor Trojan for the Windows platform.

W32/Mytob-DK runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

When first run W32/Mytob-DK displays either of the 3 following fake message boxes depending on the country setting the infected system is set:

Title (for German versions of Windows):
'Microsoft (R) Visual C++ (R)'

Message:
'Anmerkung: Die Bestimmungen dieses Endbenutzer-Lizenzvertrags fnr Visual C++ Autoren Edition lassen den Weitervertrieb der mit diesem Produkt erstellten ausfnhrbaren Dateien nicht zu.'

or

Title (for Japanese versions of Windows):
'Microsoft (R) Visual C++ (R)'

Message:
'<Japanese characters> Microsoft Visual C++ <Japanese characters>'

or

Title (for all other versions of Windows):
'Microsoft (R) Visual C++ (R)'

Message:
'Note: The terms of the End User License Agreement for Visual C++ Introductory Edition do not permit redistribution of executables you create with this Product.'

W32/Mytob-DK also includes functionality to silently download, install and run new software.

W32/Mytob-DK modifies the HOSTS file, changing the URL-to-IP mappings for selected websites, therefore preventing normal access to these sites.

W32/Mytob-DK is capable of spreading through email. Email sent by W32/Mytob-DK has the following properties:

Subject line chosen from:

'Notice of account limitation'
'Email Account Suspension'
'Security measures'
'Members Support'
'Important Notification'
'Warning Message: Your services near to be closed.'
'Your Account is Suspended For Security Reasons'
'*DETECTED* Online User Violation'
'Your Account is Suspended'
'Your new account password is approved'
'You have successfully updated your password'
'Your password has been successfully updated'
'Your password has been updated'
<random characters>

There is no message text enclosed within the email.

The attached file consists of any of the following base names followed by the extension ZIP:

'account-report'
'readme'
'account-info'
'email-details'
'account-details'
'important-details'
'accepted-password'
'account-password'
'approved-password'
'password'
'new-password'
'email-password'
'updated-password'
'document'
<random characters>

The worm may optionally create double extensions where the first extension is DOC, TXT or HTM and the final extension is PIF, SCR, EXE or ZIP.

W32/Mytob-DK harvests email addresses from files on the infected computer and from the Windows address book. W32/Mytob-DK is a mass-mailing worm and IRC backdoor Trojan for the Windows platform.

W32/Mytob-DK runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

When first run W32/Mytob-DK displays either of the 3 following fake message boxes depending on the country setting the infected system is set:

Title (for German versions of Windows):
'Microsoft (R) Visual C++ (R)'

Message:
'Anmerkung: Die Bestimmungen dieses Endbenutzer-Lizenzvertrags fnr Visual C++ Autoren Edition lassen den Weitervertrieb der mit diesem Produkt erstellten ausfnhrbaren Dateien nicht zu.'

or

Title (for Japanese versions of Windows):
'Microsoft (R) Visual C++ (R)'

Message:
'<Japanese characters> Microsoft Visual C++ <Japanese characters>'

or

Title (for all other versions of Windows):
'Microsoft (R) Visual C++ (R)'

Message:
'Note: The terms of the End User License Agreement for Visual C++ Introductory Edition do not permit redistribution of executables you create with this Product.'

W32/Mytob-DK copies itself to the Windows system folder as fuuuucktttttt.exe and creates the following registry entries:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Userinterface Reporter
fuuuucktttttt.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Userinterface Reporter
fuuuucktttttt.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Userinterface Reporter
fuuuucktttttt.exe

W32/Mytob-DK also changes the following registry entries:

from:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe

to:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe fuuuucktttttt.exe

The pathname of fuuuucktttttt.exe is also appended to the 'shell=' line in the [boot] section of <Windows>\System.ini, so that it is run on startup.

W32/Mytob-DK also disables certain system processes including the Windows XP firewall by changing the following default registry entry:

from:
HKLM\System\CurrentControlSet\Services\SharedAccess
Start
3

to:
HKLM\System\CurrentControlSet\Services\SharedAccess
Start
4

W32/Mytob-DK also includes functionality to silently download, install and run new software.

W32/Mytob-DK modifies the HOSTS file, changing the URL-to-IP mappings for selected websites, therefore preventing normal access to these sites. The new HOSTS file will typically contain the following:

127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 kaspersky-labs.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 pandasoftware.com
127.0.0.1 www.pandasoftware.com
127.0.0.1 www.trendmicro.com
127.0.0.1 www.grisoft.com
127.0.0.1 www.microsoft.com
127.0.0.1 microsoft.com
127.0.0.1 www.virustotal.com
127.0.0.1 virustotal.com
127.0.0.1 www.amazon.com
127.0.0.1 www.amazon.co.uk
127.0.0.1 www.amazon.ca
127.0.0.1 www.amazon.fr
127.0.0.1 www.paypal.com
127.0.0.1 paypal.com
127.0.0.1 moneybookers.com
127.0.0.1 www.moneybookers.com
127.0.0.1 www.ebay.com
127.0.0.1 ebay.com

W32/Mytob-DK is capable of spreading through email. Email sent by W32/Mytob-DK has the following properties:

Subject line chosen from:

'Notice of account limitation'
'Email Account Suspension'
'Security measures'
'Members Support'
'Important Notification'
'Warning Message: Your services near to be closed.'
'Your Account is Suspended For Security Reasons'
'*DETECTED* Online User Violation'
'Your Account is Suspended'
'Your new account password is approved'
'You have successfully updated your password'
'Your password has been successfully updated'
'Your password has been updated'
<random characters>

There is no message text enclosed within the email.

The attached file consists of any of the following base names followed by the extension ZIP:

'account-report'
'readme'
'account-info'
'email-details'
'account-details'
'important-details'
'accepted-password'
'account-password'
'approved-password'
'password'
'new-password'
'email-password'
'updated-password'
'document'
<random characters>

The worm may optionally create double extensions where the first extension is DOC, TXT or HTM and the final extension is PIF, SCR, EXE or ZIP.

W32/Mytob-DK harvests email addresses from files on the infected computer and from the Windows address book.