W32.Dumaru.AD@mm

W32.Dumaru.AD@mm is a multi-threaded, mass-mailing worm that downloads and runs a file, runs a keylogger, steals personal information, and starts an FTP server on port 10000. This worm is similar to the W32.Dumaru.Z@mm worm.

The worm uses its own SMTP engine to spread to the email addresses it finds on an infected system.

The email has the following characteristics:

From: "Elene" <F**KENSUICIDE@HOTMAIL.COM>  (censored)
Subject: Important information for you. Read it immediately !
Attachment: Myphoto.zip

The attachment is a zip file that contains the worm executable as myphoto.jpg <spaces> .exe". (There are numerous spaces between ".jpg" and ".exe".)


Message:
Hi !
Here is my photo, that you asked for yesterday.

---

Note: The email message contains an IFRAME exploit, so that Microsoft Outlook will download the worm from a hard-coded URL and execute it.

---

Protection

• Initial Rapid Release version February 3, 2004
• Latest Rapid Release version August 20, 2008 revision 017
• Initial Daily Certified version February 3, 2004
• Latest Daily Certified version January 20, 2009 revision 048
• Initial Weekly Certified release date February 4, 2004

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Medium

Distribution

• Distribution Level: High