This policy detects the propagation of the W32.Dumaru.Worm.

W32.Dumaru@mm is a mass-mailing worm that drops an IRC Trojan onto the infected machine. The worm gathers email addresses from certain file types and uses its own SMTP engine to email itself.

Download ITA W32_Dumaru_Worm Policy

Affected Platforms

Windows 2000
Windows NT

Description

This policy detects changes in the registry associated with the W32.Dumaru.Worm.

Policy Rules include:

• W32_Dumaru_Worm Activity
  This rule detects the changes in the registry associated with the W32.Dumaru Worm.