Infectionname: Worm Mytob.NT
Type: Worm
Other names: Symantec: W32.Mytob.AG@mm
Kaspersky: Net-Worm.Win32.Mytob.u
Sophos: W32/MyDoom-AJ
Grisoft: I-Worm/Mytob.AA
Bitdefender: Win32.Worm.Mytob.AC
Risk: High (Dangerous)
Reported by: The [SYP] SaveYourPC Team

What is a Worm?

A computer worm is a self-replicating computer program. It uses a network to send copies of itself to other nodes (computer terminals on the network) and it may do so without any user intervention. Unlike a virus, it does not need to attach itself to an existing program. Worms almost always cause harm to the network, if only by consuming bandwidth, whereas viruses almost always corrupt or modify files on a targeted computer.

How to delete Worm Mytob?

Normal Steps to delete a virus (see Fight of the Viruses - Steps to Success)

1. Update System

It is always good to update your operating system. Outdated versions offer a very high risk of infections. It is not only important to have a updated operating system, the next step is also important:

2. Latest Virusscanner

3. Combat the virus

Now we are going to eliminate the virus

 We recommend:

Load your operating system in the Safe Mode (to load the Safe Mode in  Windows press when loading Windows F8 or click Start => Run => write "msconfig" and click "OK" then press => BOOT.INI "=> crochet at startup options" / SAFEBOOT "), and turn off the System Restore, then make full system scans. Scan all files on your system, and delete all threats found with your Antivirus - and Anti - Spyware program. Then turn on the System Restore and load your operating in normal mode.

(For the safety of the virus has been deleted) Download HijackThis down and do a scan with logfile, do also (if possible) a log file of your full system scans and post us to help, by forum or by e-mail to " j_soliman@gmx.at ". CAUTION: Don´t tick and fix anything without a permit of a  specialist. There is a risk to damage your system

Search for these files and registry keys. When they were not deleted scan again and delete them! 

Files

Mytob.NT copies itself to the following locations:
   • %SYSDIR%rnathchk.exe
   • c:pic.scr
   • c:see_this!.pif
   • c:my_picture.scr



Mytob.NT copies itself within an archive to the following location:
   • %TEMPDIR%tmp%hex number%.tmp



The following files are created:

– A file that is for temporary use and it might be deleted afterwards:
   • %TEMPDIR%tmp%hex number%.tmp

 

Registry

The following registry keys are continuously in an infinite loop added in order to run the processes after reboot.

 

–  [HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunServices]
   • "RealPlayer Ath Check"="rnathchk.exe"

–  [HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun]
   • "RealPlayer Ath Check"="rnathchk.exe"

–  [HKCUSoftwareMicrosoftWindowsCurrentVersionRun]
   • "RealPlayer Ath Check"="rnathchk.exe"



The following registry keys are added:

– [HKCUSoftwareMicrosoftOLE]
   • "RealPlayer Ath Check"="rnathchk.exe"

– [HKCUSYSTEMCurrentControlSetControlLsa]
   • "RealPlayer Ath Check"="rnathchk.exe"

– [HKLMSOFTWAREMicrosoftOle]
   • "RealPlayer Ath Check"="rnathchk.exe"

– [HKLMSYSTEMCurrentControlSetControlLsa]
   • "RealPlayer Ath Check"="rnathchk.exe"