SpywareGuide powered by Actiance Security Labs
Search SpywareGuide Database & Site
Home Access the Guide
List of Products List of Companies List of Categories
Tools
X-RayPC
Terms and Definitions
 
Full Name:
W32.Mytob.AM@mm Websearch   Read More
Type: Worm
SG Index: 8 [Explain]
Category Description: Virus-like program that spreads automatically to other computers by sending itself out by email or by any other means. A program that propagates itself by attacking other machines and copying itself to the affected machine.

Worms have self-replicating code that travels from machine to machine by various means. A worms first objective is merely propagation. Worms can be destructive depending on what payload they have been given. Worms may replace files, but do not insert themselves into files.
Comment: W32.Mytob.AM@mm is a mass-mailing worm that uses its own SMTP engine to send an email to addresses that it gathers from the compromised computer.

The worm spreads by exploiting the Microsoft Windows Local Security Authority Service Remote Buffer Overflow (described in Microsoft Security Bulletin MS04-011).
   
Manual removal: 1. Disable System Restore (Windows Me/XP)

2. Open X-Cleaner and click on Expert tab. Click show all windows.

3. Find and highlight CLASS DDEMLMom. Click Kill.

4. Close the List of Active Windows windows.

5. Click on the Malware scan tab and highlight the (C:)

6. Click Start Scan for Malware.

7. Browse to C:\WINDOWS\system32\drivers\etc

8. Double click on the hosts file and open it with notepad.

9. Remove these entries from host file.

127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.microsoft.com
127.0.0.1 www.trendmicro.com

10. Save the host file.

11. Reboot after X-Cleaner finishes scanning.

Click here to leave feedback for this product

Recent Modifications
2012-5-10  NetSpy
2012-5-1  Unclassified Adware/Spyware
2012-4-11  Adult Networks/Services
2012-4-11  CoolWebSearch
2012-3-13  Misc. Exploits
2012-2-24  Zango Times
2012-2-24  About Blank
2012-1-30  HostSeeker Toolbar
2012-1-13  2000Cracks
2012-1-13  7AdPower Dialer
 
Company  | Site and Spyware FAQ
© Copyright 2003-2011, Actiance, Inc. All rights reserved.   Privacy Policy