W32.Dumaru.B@mm

W32.Dumaru.B@mm is a mass-mailing worm that drops an IRC Trojan onto an infected computer. The worm gathers email addresses from certain file types and uses its own SMTP engine to email itself.

The email has the following characteristics:

From: "Microsoft" <security@microsoft.com>
Subject: Use this patch immediately !
Message:
Dear friend , use this Internet Explorer patch now!
There are dangerous virus in the Internet now!
More than 500.000 already infected!
Attachment: Patch.exe

W32.Dumaru.B@mm will also infect the .exe files on NTFS partitions.

The worm will listen on ports:

• TCP 10000
• TCP 1001
• TCP 2283

And, the worm logs the keystrokes and sends the data to a specified email address.

On September 2, 2003, virus definitions were updated to detect minor variants of this worm.

Protection

• Initial Rapid Release version August 21, 2003
• Latest Rapid Release version July 19, 2008 revision 019
• Initial Daily Certified version August 21, 2003
• Latest Daily Certified version January 20, 2009 revision 048
• Initial Weekly Certified release date August 21, 2003

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Medium

Distribution

• Distribution Level: High