W32/Mumu.B is a network worm. This worm attempts to spread across network shares. This worm infects Windows systems. It also contains a backdoor trojan component that contains key-logging capability.

Upon execution of the worm file it copies itself as mumu.exe then copies kavfind.exe, last.exe, psexec.exe, bboy.dll and IPCPass.txt to Windows System folder. It also copies bboy.exe in the Windows folder. It modifies the registry at the following location to load itself during the next startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

After this worm attempts to spread on the network. It uses common passwords stored in the file IPCPass.txt to spread across the network. After this it tries to execute bboy.exe, on execution it initiates bboy.dll, which is a keylogger. All the Kestrokes logged into a file called QJINFO.INI and the worm tries to mail this file to an email address.

This virus first appeared on 26th June 2003.

Other names of W32/Mumu.B worm :

This worm is also known as W32.Mumu.B.Worm, W32/Mumu-C, W32/Mumu.b.worm