Technorati
Digg
Delicious
Reddit
StumbleUpon
Facebook
Yahoo
Twitter
Faves
Newsvine
- Discovered:
- September 23, 2003
- Updated:
- February 13, 2007 12:07:49 PM
- Type:
- Worm
- Systems Affected:
- Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP
W32.Dumaru.M@mm is a mass-mailing worm that drops an IRC Trojan onto an infected computer. The worm gathers email addresses from certain file types and uses its own SMTP engine to email itself.
The email has the following characteristics:
From: "Microsoft" <security@microsoft.com>
Subject: Use this patch immediately !
Message:
Dear friend , use this Internet Explorer patch now!
There are dangerous virus in the Internet now!
More than 500.000 already infected!
Attachment: Patch.exe
W32.Dumaru.M@mm will also infect the .exe files on NTFS partitions.
The worm will listen on ports:
- TCP 10000
- TCP 1001
- TCP 2283
Also, the worm logs the keystrokes and sends the data to a specified email address.
Antivirus Protection Dates
- Initial Rapid Release version September 24, 2003
- Latest Rapid Release version September 28, 2010 revision 054
- Initial Daily Certified version September 24, 2003
- Latest Daily Certified version September 28, 2010 revision 036
- Initial Weekly Certified release date September 24, 2003
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.
Threat Assessment
Wild
- Wild Level: Low
- Number of Infections: 0 - 49
- Number of Sites: 0 - 2
- Geographical Distribution: Low
- Threat Containment: Easy
- Removal: Easy
Damage
- Damage Level: Medium
Distribution
- Distribution Level: Low
Writeup By: Yana Liu
