W32/Dumaru.A@mm is a mass-mailer that distributes under the disguise of being a patch distributed by Microsoft.

W32/Dumaru.A@mm is detected by F-Prot Antivirus, using virus signature files dated 19 August 2003 or later.

W32/Dumaru.A@mm is packed with an unmodified version of UPX, and its unpacked size is 20480 bytes.

It has its own SMTP engine and drops an IRC component which F-Prot Antivirus detects as a security risk. This is a backdoor program which will connect to an IRC server and await further commands.

W32/Dumaru.A@mm adds entries to the Windows Registry, in:

The virus adds this entry to the registry in order to ensure that it will be run next time Windows starts.

The messages it sends, have the following format:

 MAIL FROM: 

 .htm
 .wab
 .html
 .dbx
 .tbb
 .abd

 %systemdir%\winload.log