W32.Dumaru.Y@mm

W32.Dumaru.Y@mm is a multi-threaded, mass-mailing worm that opens a backdoor, runs a keylogger, and attempts to steal personal information. It is similar to the W32.Dumaru.M@mm worm

This worm uses its own SMTP engine to spread to the email addresses it finds in the files on the infected system.

The email has the following characteristics:

From: "Elene" <F**KENSUICIDE@HOTMAIL.COM>  (censored)
Subject: Important information for you. Read it immediately !
Message:
Hi !
Here is my photo, that you asked for yesterday.
Attachment: Myphoto.zip

The attachment is a zip file that contains the worm executable as Myphoto.jpg   <spaces>  .exe. (There are 56 spaces between ".jpg" and ".exe".)

This worm is packed with FSG.

Protection

• Initial Rapid Release version January 26, 2004
• Latest Rapid Release version August 20, 2008 revision 017
• Initial Daily Certified version January 26, 2004
• Latest Daily Certified version January 20, 2009 revision 048
• Initial Weekly Certified release date January 26, 2004

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Medium
• Number of Infections: More than 1000
• Number of Sites: More than 10
• Geographical Distribution: Medium
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Medium

Distribution

• Distribution Level: High