Technorati
Digg
Delicious
Reddit
StumbleUpon
Facebook
Yahoo
Twitter
Faves
Newsvine
- Discovered:
- February 10, 2004
- Updated:
- February 13, 2007 12:17:17 PM
- Also Known As:
- W32/Mimail.u@MM [McAfee], Win32.Mimail.U[Computer Associ
- Type:
- Worm
- Systems Affected:
- Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP
W32.Dumaru.AH@mm is a multi-threaded, mass-mailing worm that opens a backdoor, runs a keylogger, and attempts to steal personal information. The worm uses its own SMTP engine to spread to email addresses that it finds in the files on an infected system.
The email has the following characteristics:
From: random characters@<a domain from an email addresses found on the infected computer>
Subject: Unknown
Attachment: document.zip (The attachment is a zip file that contains the worm executable, myphoto.jpg<56 spaces>.exe.)
The worm is similar to the W32.Dumaru.Y@mm worm and arrives as a dropper.
Antivirus Protection Dates
- Initial Rapid Release version February 11, 2004
- Latest Rapid Release version September 28, 2010 revision 054
- Initial Daily Certified version February 11, 2004
- Latest Daily Certified version September 28, 2010 revision 036
- Initial Weekly Certified release date February 11, 2004
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.
Threat Assessment
Wild
- Wild Level: Low
- Number of Infections: 0 - 49
- Number of Sites: 0 - 2
- Geographical Distribution: Low
- Threat Containment: Easy
- Removal: Moderate
Damage
- Damage Level: Medium
Distribution
- Distribution Level: High
Writeup By: Yana Liu
