W32.Dumaru.AH@mm

W32.Dumaru.AH@mm is a multi-threaded, mass-mailing worm that opens a backdoor, runs a keylogger, and attempts to steal personal information. The worm uses its own SMTP engine to spread to email addresses that it finds in the files on an infected system.

The email has the following characteristics:

From: random characters@<a domain from an email addresses found on the infected computer>
Subject: Unknown
Attachment: document.zip (The attachment is a zip file that contains the worm executable, myphoto.jpg<56 spaces>.exe.)

The worm is similar to the W32.Dumaru.Y@mm worm and arrives as a dropper.

Protection

• Initial Rapid Release version February 11, 2004
• Latest Rapid Release version October 3, 2009 revision 007
• Initial Daily Certified version February 11, 2004
• Latest Daily Certified version October 3, 2009 revision 020
• Initial Weekly Certified release date February 11, 2004

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Medium

Distribution

• Distribution Level: High