WORM_MYTOB.BZ

This worm propagates via network shares and email messages. Upon execution, it drops a copy of itself in the Windows system folder as the file TASKGMR.EXE. It also creates several registry entries to ensure its execution every system startup.

This worm takes advantage of the LSASS Windows vulnerability to propagate across networks. For more information about this vulnerability, please refer to the following Microsoft Web page:

Microsoft Security Bulletin MS04-011

It prevents users from accessing several antivirus and security Web sites by redirecting the connection to the local machine.

It also drops a component file, which is responsible for creating copies of this worm. Trend Micro detects the said component file as WORM_MYTOB.J.

Related Items