W32/Mytob-HJ

Category	Viruses and Spyware
Type	Worm
What to do	If you've received an alert for a virus or spyware, then follow the instructions for removing the threat.
Prevalence	low high

Summary

Summary
Action
More Information


How it spreads	Email attachments
Affected operating systems	Windows
Characteristics	Installs itself in the registry
Protection available since	19 April 2006 14:26:20 (GMT)
Detected by	All Sophos products

Free virus scan
Download the Threat Detection Test

Free virus, spyware, and adware scan
Test your existing anti-virus protection
Find threats your anti-virus missed

Action

Summary
Action
More Information

Please follow the instructions for removing worms.

Replace the Hosts file from a backup or edit it in Notepad to remove the changes that the worm has made.

You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

and remove any reference to any file you deleted.

Close the registry editor.

More Information

Summary
Action
More Information

W32/Mytob-HJ is a mass-mailing worm and backdoor Trojan that can be controlled
through the Internet Relay Chat (IRC) network.

W32/Mytob-HJ spreads through email. W32/Mytob-HJ harvests email addresses from
files on the infected computer and from the Windows address book. Email sent by
W32/Mytob-HJ has the following properties:

Subject line:

*DETECTED* Online User Violation
Email Account Suspension
Important Notification
Members Support
Security measures
Warning Message: Your services near to be closed.
You have successfully updated your password
Your Account is Suspended
Your Account is Suspended For Security Reasons
Your new account password is approved
Your password has been successfully updated
Your password has been updated

Message text:

Dear user <string>,
You have successfully updated the password of your <string> account.
If you did not authorize this change or if you need assistance with your
account, please contact <string> customer service at: <string>
Thank you for using <string>!
The <string> Support Team
+++ Attachment: No Virus (Clean)
+++ <string> Antivirus - www.<string>

Dear user <string>,
It has come to our attention that your <string> User Profile ( x ) records are
out of date. For further details see the attached document.
Thank you for using <string>!
The <string> Support Team
+++ Attachment: No Virus (Clean)
+++ <string> Antivirus - www.<string>

Dear <string> Member,
We have temporarily suspended your email account <string>.
This might be due to either of the following reasons:
1. A recent change in your personal information (i.e. change of address).
2. Submiting invalid information during the initial sign up process.
3. An innability to accurately verify your selected option of subscription due
to an internal error within our processors.
See the details to reactivate your <string> account.
Sincerely,The <string> Support Team
+++ Attachment: No Virus (Clean)
+++ <string> Antivirus - www.<string>

Dear <string> Member,
Your e-mail account was used to send a huge amount of unsolicited spam messages
during the recent week. If you could please take 5-10 minutes out of your online
experience and confirm the attached document so you will not run into any future
problems with the online service.
If you choose to ignore our request, you leave us no choice but to cancel your
membership.
Virtually yours,
The <string> Support Team
+++ Attachment: No Virus found
+++ <string> Antivirus - www.<string>

In the above message text samples <string> would be replaced from text aquired
from the harvested email addresses.

The attached file consists of a base name followed by the extensions CMD, PIF,
SCR, EXE or ZIP. The worm may optionally create double extensions where the
first extension is DOC, TXT or HTM and the final extension is BAT, CMD, PIF,
SCR, EXE or ZIP. The base filenames are randomly chosen from:

accepted-password
account-details
account-info
account-password
account-report
approved-password
document
email-details
email-password
important-details
new-password
password
readme
updated-password

The worm avoids sending email to addresses that contain the following:

.gov
.mil
accoun
acketst
admin
anyone
arin.
avp
berkeley
borlan
bsd
bsd
bugs
ca
certific
contact
example
feste
fido
foo.
fsf.
gnu
gold-certs
google
google
gov.
help
iana
ibm.com
icrosof
icrosoft
ietf
info
inpris
isc.o
isi.e
kernel
linux
linux
listserv
math
me
mit.e
mozilla
mydomai
no
nobody
nodomai
noone
not
nothing
ntivi
page
panda
pgp
postmaster
privacy
rating
rfc-ed
ripe.
root
ruslis
samples
secur
sendmail
service
site
soft
somebody
someone
sopho
submit
support
syma
tanford.e
the.bat
unix
unix
usenet
utgers.ed
webmaster
you
your W32/Mytob-HJ is a mass-mailing worm and backdoor Trojan that can be controlled
through the Internet Relay Chat (IRC) network.

When first run W32/Mytob-HJ copies itself to <System>\scalpe91.exe.

The following registry entries are created to run scalpe91.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WINDOWS SYSTEM SCALPE
scalpe91.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
WINDOWS SYSTEM SCALPE
scalpe91.exe

W32/Mytob-HJ sets the following registry entries, disabling the automatic
startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4