1. Symantec/
  2. Security Response/
  3. W32.Dumaru.Y@mm


Risk Level 2: Low

January 23, 2004
February 13, 2007 12:16:37 PM
Also Known As:
W32/Dumaru.y@MM [McAfee], I-Worm.Dumaru.j [Kaspersky], Win32.Dumaru.Y [Computer Assoc, W32/Dumaru-Y [Sophos], WORM_DUMARU.Y [Trend]
Systems Affected:
Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

W32.Dumaru.Y@mm is a multi-threaded, mass-mailing worm that opens a backdoor, runs a keylogger, and attempts to steal personal information. It is similar to the W32.Dumaru.M@mm worm

This worm uses its own SMTP engine to spread to the email addresses it finds in the files on the infected system.

The email has the following characteristics:

From: "Elene" <F**KENSUICIDE@HOTMAIL.COM>  (censored)
Subject: Important information for you. Read it immediately !
Hi !
Here is my photo, that you asked for yesterday.
Attachment: Myphoto.zip

The attachment is a zip file that contains the worm executable as Myphoto.jpg   <spaces>  .exe. (There are 56 spaces between ".jpg" and ".exe".)

This worm is packed with FSG.

Antivirus Protection Dates

  • Initial Rapid Release version January 26, 2004
  • Latest Rapid Release version September 28, 2010 revision 054
  • Initial Daily Certified version January 26, 2004
  • Latest Daily Certified version September 28, 2010 revision 036
  • Initial Weekly Certified release date January 26, 2004
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.
Writeup By: Heather Shannon

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
2016 Internet Security Threat Report, Volume 21
  • Twitter
  • Facebook
  • LinkedIn
  • Google+
  • YouTube