Malware type: Worm

Aliases: Backdoor.Win32.Dumador.ag (Kaspersky), W32/Dumaru.ai@MM (McAfee), Backdoor.Nibu.E (Symantec), TR/Qhost.A.1 (Avira), Troj/Dumaru-AJ (Sophos), Backdoor:Win32/Dumador.JL (Microsoft)

In the wild: Yes

Destructive: No

Language: English

Platform: Windows 95, 98, NT, ME, 2000, XP

Encrypted: No

Description: 

This worm logs keystrokes and gathers information from the infected system, sending these to a remote malcious user via email. It also gathers clipboard and protected storage data, as well as user information related to E-gold bank accounts and Web money.

It can also send the following system information to a particular Web site:

• Storage data
• Internet Explorer Version
• Operating System and version
• IP address
• Screen Capture

This worm also modifies the system's HOSTS file, preventing users to access antivirus Web sites to upgrade their antivirus patterns.

It runs on Windows 95, 98, NT, ME, 2000, and XP.

For additional information about this threat, see:
Solution
Technical Details

Description created: May. 7, 2004 10:11:46 AM GMT -0800

Search a new malware

Tell us how we did. Take our quick survey.