W32.Dumaru.Y@mm is a multi-threaded, mass-mailing worm that opens a backdoor, runs a keylogger, and attempts to steal personal information. It is similar to the
W32.Dumaru.M@mm worm
This worm uses its own SMTP engine to spread to the email addresses it finds in the files on the infected system.
The email has the following characteristics:
From: "Elene" <F**KENSUICIDE@HOTMAIL.COM> (censored)
Subject: Important information for you. Read it immediately !
Message:
Hi !
Here is my photo, that you asked for yesterday.
Attachment: Myphoto.zip
The attachment is a zip file that contains the worm executable as
Myphoto.jpg <spaces> .exe. (There are 56 spaces between ".jpg" and ".exe".)
This worm is packed with FSG.
Click for a more detailed description of Rapid Release and Daily Certified virus definitions.
