Virus:Worm/Mytob.F.1
Date discovered:23/03/2005
Type:Worm
In the wild:Yes
Reported Infections:Low
Distribution Potential:Low
Damage Potential:Low
Static file:Yes
File size:6.050 Bytes
MD5 checksum:526889b766bb23a3ac2bf20820f212ee
VDF version:6.30.00.43

 General Method of propagation:
   • Messenger


Aliases:
   •  Symantec: W32.Mytob.L@mm
   •  Kaspersky: Net-Worm.Win32.Mytob.f
   •  TrendMicro: WORM_MYTOB.J
   •  Grisoft: I-Worm/Mytob.E
   •  VirusBuster: I-Worm.Mytob.I
   •  Bitdefender: Worm.Mytob.F


Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

 Files It tries to execute the following file:

– Filename:
   • %PROGRAM FILES%\Messenger\msmsgs.exe

 Messenger It is spreading via Messenger. The characteristics are described below:

– Windows Live Messenger
– Windows Messenger


To:
All online contacts in the contact list.


Propagation via file
It sends a file with one of the following filenames:
   • C:\funny_pic.scr
   • C:\see_this.scr
   • C:\my_photo2005.scr

 File details Programming language:
 The malware program was written in Visual Basic.


Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
   • FSG

Description inserted by Andrei Gherman on Thursday, February 2, 2006
Description updated by Andrei Gherman on Wednesday, April 19, 2006

Back . . . .