W32/Mytob-KD

Please follow the instructions for removing worms.

W32/Mytob-KD is a mass-mailing worm and backdoor Trojan that can be controlled through the Internet Relay Chat (IRC) network.

W32/Mytob-KD is a mass-mailing worm and backdoor Trojan that can be controlled through the Internet Relay Chat (IRC) network.

W32/Mytob-KD is capable of spreading through email and through various operating system vulnerabilities such as the LSASS (MS04-011) vulnerability. Email sent by W32/Mytob-KD has the following properties:

Subject line:
  Notice: **Last Warning**
  *DETECTED* Online User Violation
  Your Email Account is Suspended For Security Reasons
  Account Alert
  Important Notification
  *WARNING* Your Email Account Will Be Closed
  Security measures
  Email Account Suspension
  Notice of account limitation

Message text:
  Once you have completed the form in the attached file , your account records will not be interrupted and will continue as normal.

  The original message has been included as an attachment.

  We regret to inform you that your account has been suspended due to the violation of our site policy, more info is attached.
  
  We attached some important information regarding your account.
  
  Please read the attached document and follow it's instructions.

The attached zip file consists of a base name followed by the extension ZIP. The worm may optionally create double extensions where the first extension is DOC, TXT or HTM and the final extension is BAT, CMD, PIF, SCR, EXE or ZIP. The base filenames are randomly chosen from:

account-details.zip
important-details.zip
email-details.zip
password-details.zip
email-password.zip
updated-password.zip

W32/Mytob-KD harvests email addresses from files on the infected computer and from the Windows address book. The worm avoids sending email to addresses that contain the following:

.gov
.mil
accoun
acketst
admin
anyone
arin.
avp
berkeley
borlan
bsd
bsd
bugs
ca
certific
contact
example
feste
fido
foo.
fsf.
gnu
gold-certs
google
google
gov.
help
iana
ibm.com
icrosof
icrosoft
ietf
info
inpris
isc.o
isi.e
kernel
linux
linux
listserv
math
me
mit.e
mozilla
mydomai
no
nobody
nodomai
noone
not
nothing
ntivi
page
panda
pgp
postmaster
privacy
rating
rfc-ed
ripe.
root
ruslis
samples
secur
sendmail
service
site
soft
somebody
someone
sopho
submit
support
syma
tanford.e
the.bat
unix
unix
usenet
utgers.ed
webmaster
you
your

When run, W32/Mytob-KD copies itself to the Windows system folder as ctech.exe and sets the following registry entries in order to run each time a user logs on:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
WINDOWS SYSTEM
ctech.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\
WINDOWS SYSTEM
ctech.exe

W32/Mytob-KD sets the following registry entries, disabling the automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4

W32/Mytob-KD modifies the HOSTS file, changing the URL-to-IP mappings for selected websites, therefore preventing normal access to these sites:

127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 kaspersky-labs.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.trendmicro.com
127.0.0.1 www.grisoft.com
127.0.0.1 www.microsoft.com
127.0.0.1 microsoft.com
127.0.0.1 www.msn.com
127.0.0.1 www.virustotal.com
127.0.0.1 virustotal.com
127.0.0.1 www.oxyd.fr
127.0.0.1 oxyd.fr
127.0.0.1 www.t35.com
127.0.0.1 t35.com
127.0.0.1 www.t35.net
127.0.0.1 t35.net

W32/Mytob-KD terminates the following applications and security-related processes:

  ACKWIN32.EXE
  ADAWARE.EXE
  ADVXDWIN.EXE
  AGENTSVR.EXE
  AGENTW.EXE
  ALERTSVC.EXE
  ALEVIR.EXE
  ALOGSERV.EXE
  AMON9X.EXE
  ANTI-TROJAN.EXE
  ANTIVIRUS.EXE
  ANTS.EXE
  APIMONITOR.EXE
  APLICA32.EXE
  APVXDWIN.EXE
  ARR.EXE
  ATCON.EXE
  ATGUARD.EXE
  ATRO55EN.EXE
  ATUPDATER.EXE
  ATUPDATER.EXE
  ATWATCH.EXE
  AU.EXE
  AUPDATE.EXE
  AUPDATE.EXE
  AUTO-PROTECT.NAV80TRY.EXE
  AUTODOWN.EXE
  AUTODOWN.EXE
  AUTOTRACE.EXE
  AUTOTRACE.EXE
  AUTOUPDATE.EXE
  AUTOUPDATE.EXE
  AVCONSOL.EXE
  AVE32.EXE
  AVGCC32.EXE
  AVGCTRL.EXE
  AVGNT.EXE
  AVGSERV.EXE
  AVGSERV9.EXE
  AVGUARD.EXE
  AVGW.EXE
  AVKPOP.EXE
  AVKSERV.EXE
  AVKSERVICE.EXE
  AVKWCTl9.EXE
  AVLTMAIN.EXE
  AVNT.EXE
  AVP.EXE
  AVP32.EXE
  AVPCC.EXE
  AVPDOS32.EXE
  AVPM.EXE
  AVPTC32.EXE
  AVPUPD.EXE
  AVPUPD.EXE
  AVSCHED32.EXE
  AVSYNMGR.EXE
  AVWINNT.EXE
  AVWUPD.EXE
  AVWUPD32.EXE
  AVWUPD32.EXE
  AVWUPSRV.EXE
  AVXMONITOR9X.EXE
  AVXMONITORNT.EXE
  AVXQUAR.EXE
  AVXQUAR.EXE
  BACKWEB.EXE
  BARGAINS.EXE
  BD_PROFESSIONAL.EXE
  BEAGLE.EXE
  BELT.EXE
  BIDEF.EXE
  BIDSERVER.EXE
  BIPCP.EXE
  BIPCPEVALSETUP.EXE
  BISP.EXE
  BLACKD.EXE
  BLACKICE.EXE
  BLSS.EXE
  BOOTCONF.EXE
  BOOTWARN.EXE
  BORG2.EXE
  BPC.EXE
  BRASIL.EXE
  BS120.EXE
  BUNDLE.EXE
  BVT.EXE
  CCAPP.EXE
  CCEVTMGR.EXE
  CCPXYSVC.EXE
  CDP.EXE
  CFD.EXE
  CFGWIZ.EXE
  CFIADMIN.EXE
  CFIAUDIT.EXE
  CFIAUDIT.EXE
  CFINET.EXE
  CFINET32.EXE
  CLAW95CF.EXE
  CLEAN.EXE
  CLEANER.EXE
  CLEANER3.EXE
  CLEANPC.EXE
  CLICK.EXE
  CMD.EXE
  CMD32.EXE
  CMESYS.EXE
  CMGRDIAN.EXE
  CMON016.EXE
  CONNECTIONMONITOR.EXE
  CPD.EXE
  CPF9X206.EXE
  CPFNT206.EXE
  CTRL.EXE
  CV.EXE
  CWNB181.EXE
  CWNTDWMO.EXE
  DATEMANAGER.EXE
  DCOMX.EXE
  DEFALERT.EXE
  DEFSCANGUI.EXE
  DEFWATCH.EXE
  DEPUTY.EXE
  DIVX.EXE
  DLLCACHE.EXE
  DLLREG.EXE
  DOORS.EXE
  DPF.EXE
  DPFSETUP.EXE
  DPPS2.EXE
  DRWATSON.EXE
  DRWEB32.EXE
  DRWEBUPW.EXE
  DSSAGENT.EXE
  DVP95.EXE
  DVP95_0.EXE
  ECENGINE.EXE
  EFPEADM.EXE
  EMSW.EXE
  ENT.EXE
  ESAFE.EXE
  ESCANHNT.EXE
  ESCANV95.EXE
  ESPWATCH.EXE
  ETHEREAL.EXE
  ETRUSTCIPE.EXE
  EVPN.EXE
  EXANTIVIRUS-CNET.EXE
  EXE.AVXW.EXE
  EXPERT.EXE
  EXPLORE.EXE
  F-PROT.EXE
  F-PROT95.EXE
  F-STOPW.EXE
  FAMEH32.EXE
  FAST.EXE
  FCH32.EXE
  FIH32.EXE
  FINDVIRU.EXE
  FIREWALL.EXE
  FNRB32.EXE
  FP-WIN.EXE
  FP-WIN_TRIAL.EXE
  FPROT.EXE
  FRW.EXE
  FSAA.EXE
  FSAV.EXE
  FSAV32.EXE
  FSAV530STBYB.EXE
  FSAV530WTBYB.EXE
  FSAV95.EXE
  FSGK32.EXE
  FSM32.EXE
  FSMA32.EXE
  FSMB32.EXE
  GATOR.EXE
  GBMENU.EXE
  GBPOLL.EXE
  GENERICS.EXE
  GMT.EXE
  GUARD.EXE
  GUARDDOG.EXE
  HACKTRACERSETUP.EXE
  HBINST.EXE
  HBSRV.EXE
  HOTACTIO.EXE
  HOTPATCH.EXE
  HTLOG.EXE
  HTPATCH.EXE
  HWPE.EXE
  HXDL.EXE
  HXIUL.EXE
  IAMAPP.EXE
  IAMSERV.EXE
  IAMSTATS.EXE
  IBMASN.EXE
  IBMAVSP.EXE
  ICLOADNT.EXE
  ICMON.EXE
  ICSUPP95.EXE
  ICSUPPNT.EXE
  IDLE.EXE
  IEDLL.EXE
  IEDRIVER.EXE
  IEXPLORER.EXE
  IFACE.EXE
  IFW2000.EXE
  INETLNFO.EXE
  INFUS.EXE
  INFWIN.EXE
  INIT.EXE
  INTDEL.EXE
  INTREN.EXE
  IOMON98.EXE
  ISTSVC.EXE
  JAMMER.EXE
  JDBGMRG.EXE
  JEDI.EXE
  KAVLITE40ENG.EXE
  KAVPERS40ENG.EXE
  KAVPF.EXE
  KAZZA.EXE
  KEENVALUE.EXE
  KERIO-PF-213-EN-WIN.EXE
  KERIO-WRL-421-EN-WIN.EXE
  KERIO-WRP-421-EN-WIN.EXE
  KERNEL32.EXE
  KILLPROCESSSETUP161.EXE
  LAUNCHER.EXE
  LDNETMON.EXE
  LDPRO.EXE
  LDPROMENU.EXE
  LDSCAN.EXE
  LNETINFO.EXE
  LOADER.EXE
  LOCALNET.EXE
  LOCKDOWN.EXE
  LOCKDOWN2000.EXE
  LOOKOUT.EXE
  LORDPE.EXE
  LSETUP.EXE
  LUALL.EXE
  LUALL.EXE
  LUAU.EXE
  LUCOMSERVER.EXE
  LUINIT.EXE
  LUSPT.EXE
  MAPISVC32.EXE
  MCAGENT.EXE
  MCMNHDLR.EXE
  MCSHIELD.EXE
  MCTOOL.EXE
  MCUPDATE.EXE
  MCUPDATE.EXE
  MCVSRTE.EXE
  MCVSSHLD.EXE
  MD.EXE
  MFIN32.EXE
  MFW2EN.EXE
  MFWENG3.02D30.EXE
  MGAVRTCL.EXE
  MGAVRTE.EXE
  MGHTML.EXE
  MGUI.EXE
  MINILOG.EXE
  MMOD.EXE
  MONITOR.EXE
  MOOLIVE.EXE
  MOSTAT.EXE
  MPFAGENT.EXE
  MPFSERVICE.EXE
  MPFTRAY.EXE
  MRFLUX.EXE
  MSAPP.EXE
  MSBB.EXE
  MSBLAST.EXE
  MSCACHE.EXE
  MSCCN32.EXE
  MSCMAN.EXE
  MSCONFIG.EXE
  MSDM.EXE
  MSDOS.EXE
  MSIEXEC16.EXE
  MSINFO32.EXE
  MSLAUGH.EXE
  MSMGT.EXE
  MSMSGRI32.EXE
  MSSMMC32.EXE
  MSSYS.EXE
  MSVXD.EXE
  MU0311AD.EXE
  MWATCH.EXE
  N32SCANW.EXE
  NAV.EXE
  NAVAP.NAVAPSVC.EXE
  NAVAPSVC.EXE
  NAVAPW32.EXE
  NAVDX.EXE
  NAVLU32.EXE
  NAVNT.EXE
  NAVSTUB.EXE
  NAVW32.EXE
  NAVWNT.EXE
  NC2000.EXE
  NCINST4.EXE
  NDD32.EXE
  NEOMONITOR.EXE
  NEOWATCHLOG.EXE
  NETARMOR.EXE
  NETD32.EXE
  NETINFO.EXE
  NETMON.EXE
  NETSCANPRO.EXE
  NETSPYHUNTER-1.2.EXE
  NETSTAT.EXE
  NETUTILS.EXE
  NISSERV.EXE
  NISUM.EXE
  NMAIN.EXE
  NOD32.EXE
  NORMIST.EXE
  NORTON_INTERNET_SECU_3.0_407.EXE
  NOTSTART.EXE
  NPF40_TW_98_NT_ME_2K.EXE
  NPFMESSENGER.EXE
  NPROTECT.EXE
  NPSCHECK.EXE
  NPSSVC.EXE
  NSCHED32.EXE
  NSSYS32.EXE
  NSTASK32.EXE
  NSUPDATE.EXE
  NT.EXE
  NTRTSCAN.EXE
  NTVDM.EXE
  NTXconfig.EXE
  NUI.EXE
  NUPGRADE.EXE
  NUPGRADE.EXE
  NVARCH16.EXE
  NVC95.EXE
  NVSVC32.EXE
  NWINST4.EXE
  NWSERVICE.EXE
  NWTOOL16.EXE
  OLLYDBG.EXE
  ONSRVR.EXE
  OPTIMIZE.EXE
  OSTRONET.EXE
  OTFIX.EXE
  OUTPOST.EXE
  OUTPOST.EXE
  OUTPOSTINSTALL.EXE
  OUTPOSTPROINSTALL.EXE
  PADMIN.EXE
  PANIXK.EXE
  PATCH.EXE
  PAVCL.EXE
  PAVPROXY.EXE
  PAVSCHED.EXE
  PAVW.EXE
  PCFWALLICON.EXE
  PCIP10117_0.EXE
  PCSCAN.EXE
  PDSETUP.EXE
  PERISCOPE.EXE
  PERSFW.EXE
  PERSWF.EXE
  PF2.EXE
  PFWADMIN.EXE
  PGMONITR.EXE
  PINGSCAN.EXE
  PLATIN.EXE
  POP3TRAP.EXE
  POPROXY.EXE
  POPSCAN.EXE
  PORTDETECTIVE.EXE
  PORTMONITOR.EXE
  POWERSCAN.EXE
  PPINUPDT.EXE
  PPTBC.EXE
  PPVSTOP.EXE
  PRIZESURFER.EXE
  PRMT.EXE
  PRMVR.EXE
  PROCDUMP.EXE
  PROCESSMONITOR.EXE
  PROCEXPLORERV1.0.EXE
  PROGRAMAUDITOR.EXE
  PROPORT.EXE
  PROTECTX.EXE
  PSPF.EXE
  PURGE.EXE
  QCONSOLE.EXE
  QSERVER.EXE
  RAPAPP.EXE
  RAV7.EXE
  RAV7WIN.EXE
  RAV8WIN32ENG.EXE
  RAY.EXE
  RB32.EXE
  RCSYNC.EXE
  REALMON.EXE
  REGED.EXE
  REGEDIT.EXE
  REGEDT32.EXE
  RESCUE.EXE
  RESCUE32.EXE
  RRGUARD.EXE
  RSHELL.EXE
  RTVSCAN.EXE
  RTVSCN95.EXE
  RULAUNCH.EXE
  RUN32DLL.EXE
  RUNDLL.EXE
  RUNDLL16.EXE
  RUXDLL32.EXE
  SAFEWEB.EXE
  SAHAGENT.EXE
  SAVE.EXE
  SAVENOW.EXE
  SBSERV.EXE
  SC.EXE
  SCAM32.EXE
  SCAN32.EXE
  SCAN95.EXE
  SCANPM.EXE
  SCRSCAN.EXE
  SETUPVAMEEVAL.EXE
  SETUP_FLOWPROTECTOR_US.EXE
  SFC.EXE
  SGSSFW32.EXE
  SH.EXE
  SHELLSPYINSTALL.EXE
  SHN.EXE
  SHOWBEHIND.EXE
  SMC.EXE
  SMS.EXE
  SMSS32.EXE
  SOAP.EXE
  SOFI.EXE
  SPERM.EXE
  SPF.EXE
  SPHINX.EXE
  SPOLER.EXE
  SPOOLCV.EXE
  SPOOLSV32.EXE
  SPYXX.EXE
  SREXE.EXE
  SRNG.EXE
  SS3EDIT.EXE
  SSGRATE.EXE
  SSG_4104.EXE
  ST2.EXE
  START.EXE
  STCLOADER.EXE
  SUPFTRL.EXE
  SUPPORT.EXE
  SUPPORTER5.EXE
  SVC.EXE
  SVCHOSTC.EXE
  SVCHOSTS.EXE
  SVSHOST.EXE
  SWEEP95.EXE
  SWEEPNET.SWEEPSRV.SYS.SWNETSUP.EXE
  SYMPROXYSVC.EXE
  SYMTRAY.EXE
  SYSEDIT.EXE
  SYSTEM.EXE
  SYSTEM32.EXE
  SYSUPD.EXE
  TASKMG.EXE
  TASKMGR.EXE
  TASKMO.EXE
  TASKMON.EXE
  TAUMON.EXE
  TBSCAN.EXE
  TC.EXE
  TCA.EXE
  TCM.EXE
  TDS-3.EXE
  TDS2-NT.EXE
  TEEKIDS.EXE
  TFAK.EXE
  TFAK5.EXE
  TGBOB.EXE
  TITANIN.EXE
  TITANINXP.EXE
  TRACERT.EXE
  TRICKLER.EXE
  TRJSCAN.EXE
  TRJSETUP.EXE
  TROJANTRAP3.EXE
  TSADBOT.EXE
  TVMD.EXE
  TVTMD.EXE
  UNDOBOOT.EXE
  UPDAT.EXE
  UPDATE.EXE
  UPDATE.EXE
  UPGRAD.EXE
  UTPOST.EXE
  VBCMSERV.EXE
  VBCONS.EXE
  VBUST.EXE
  VBWIN9X.EXE
  VBWINNTW.EXE
  VCSETUP.EXE
  VET32.EXE
  VET95.EXE
  VETTRAY.EXE
  VFSETUP.EXE
  VIR-HELP.EXE
  VIRUSMDPERSONALFIREWALL.EXE
  VNLAN300.EXE
  VNPC3000.EXE
  VPC32.EXE
  VPC42.EXE
  VPFW30S.EXE
  VPTRAY.EXE
  VSCAN40.EXE
  VSCENU6.02D30.EXE
  VSCHED.EXE
  VSECOMR.EXE
  VSHWIN32.EXE
  VSISETUP.EXE
  VSMAIN.EXE
  VSMON.EXE
  VSSTAT.EXE
  VSWIN9XE.EXE
  VSWINNTSE.EXE
  VSWINPERSE.EXE
  W32DSM89.EXE
  W9X.EXE
  WATCHDOG.EXE
  WEBDAV.EXE
  WEBSCANX.EXE
  WEBTRAP.EXE
  WFINDV32.EXE
  WHOSWATCHINGME.EXE
  WIMMUN32.EXE
  WIN-BUGSFIX.EXE
  WIN32.EXE
  WIN32US.EXE
  WINACTIVE.EXE
  WINDOW.EXE
  WINDOWS.EXE
  WININETD.EXE
  WININIT.EXE
  WININITX.EXE
  WINLOGIN.EXE
  WINMAIN.EXE
  WINNET.EXE
  WINPPR32.EXE
  WINRECON.EXE
  WINSERVN.EXE
  WINSSK32.EXE
  WINSTART.EXE
  WINSTART001.EXE
  WINTSK32.EXE
  WINUPDATE.EXE
  WKUFIND.EXE
  WNAD.EXE
  WNT.EXE
  WRADMIN.EXE
  WRCTRL.EXE
  WSBGATE.EXE
  WUPDATER.EXE
  WUPDT.EXE
  WYVERNWORKSFIREWALL.EXE
  XPF202EN.EXE
  ZAPRO.EXE
  ZAPSETUP3001.EXE
  ZATUTOR.EXE
  ZONALM2601.EXE
  ZONEALARM.EXE
  _AVP32.EXE
  _AVPCC.EXE
  _AVPM.EXE