Internet threat level: 1
Home→Descriptions→Email-Worm.Win32.Mydoom.g
Email-Worm.Win32.Mydoom.g
| Detected | May 23 2004 18:43 GMT |
| Released | May 23 2004 18:43 GMT |
| Published | Aug 03 2004 10:18 GMT |
Technical Details
This worm spreads via the Internet as an attachment to infected messages. The worm itself is a Windows PE EXE file of 32256 bytes, packed using UPX.
The worm will be launched only if the user opens the archive and executes the infected file. The worm will then install itself to the system and start propagating.
The worm includes a backdoor function, and is also coded to conduct a DoS attack on www.symantec.com and symantec.com
Once the file has been unpacked, the following text string is visible:
to netsky's creator(s): imho, skynet is a decentralized peer-to-peer neural network. we have seen P2P in Slapper in Sinit only. they may be called skynets, but not your shitty app.
Installation
Once the worm is launched, it may open Windows Notepad, which will display a random selection of characters.
When installing, the worm copies itself under a random name, with the extension .exe or .scr to the Windows system directory. It registers this file in the system registry to ensure that the worm is launched each time Windows is started:
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run] [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "<random characters>"="%System%\<name of file>"
The worm creates a file with a random name and a .dll extension in the Windows system directory. This is the backdoor component. This file is also registered in the system registry:
[HKCR\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32]
"<random characters>"="%System%\<name of file.dll>"
This ensures that the DLL is launched as an Explorer.exe child process.
To flag its presence in the system, the worm creates a mutex <name of computer>theta,. This ensures that only one copy of the worm can be launched at once.
The worm copies itself to all accessible hard disks under a random name; it also creates copies of itself in ZIP archives.
It searches all accessible hard drives for files with the extensions listed below. It then creates copies of itself under these file names, adding either an .exe or a .pif extension.
avi doc jpg mp3 mp4 wav wma xls
Mass mailing
The mass mailing function is similar to the other versions of Mydoom, with a few insignificant differences.
Remote administration
The worm opens TCP ports 80 and 1080 to receive commands. The backdoor component can act as a proxy server, and also download and launch files.
Other
The worm is coded to detect and terminate the following processes in memory:
adaware.exe alevir.exe arr.exe au.exe avpupd avwupd backweb.exe bargains.exe beagle belt.exe blss.exe bootconf.exe bpc.exe brasil.exe bundle.exe bvt.exe cfd.exe click cmd32.exe cmesys.exe d3du datemanager.exe dcomx.exe divx.exe dllcache.exe dllreg.exe dpps2.exe dssagent.exe emsw.exe explore.exe fsg_4104.exe fuck gator.exe gmt.exe hbinst.exe hbsrv.exe hotactio hotfix.exe hotpatch.exe htpatch.exe hxdl.exe hxiul.exe |
idle.exe iedll.exe iedriver.exe iexplorer.exe inetlnfo.exe infus.exe infwin.exe init.exe intdel.exe intren isass.exe istsvc.exe jdbgmrg.exe kazza.exe keenvalue.exe kernel32.exe launcher.exe lnetinfo.exe loader.exe mapisvc32.exe md.exe mfin32.exe mmod.exe mostat.exe msapp.exe msbb.exe msblast.exe mscache.exe msccn32.exe mscman.exe msdm.exe msdos.exe msiexec16.exe mslaugh.exe msmgt.exe msmsgri32.exe msrexe.exe mssys.exe msvxd.exe netd32.exe nssys32.exe nstask32.exe |
nsupdate.exe onsrvr.exe optimize.exe patch.exe penis pgmonitr.exe porn powerscan.exe prizesurfer.exe prmt.exe prmvr.exe pussy ray.exe rb32.exe rcsync.exe reged run32dll.exe rundll.exe rundll16.exe ruxdll32.exe sahagent.exe save.exe savenow.exe sc.exe scam32.exe scrsvr.exe scvhost.exe service.exe servlce.exe servlces.exe showbehind.exe sms.exe smss32.exe soap.exe sperm spoler.exe spoolcv.exe spoolsv32.exe srng.exe ssgrate.exe start.exe stcloader.exe |
support.exe svc.exe svchostc.exe svchosts.exe svshost.exe system.exe system32.exe sysupd.exe taskmg taskmo teekids.exe trickler.exe tsadbot.exe tvmd.exe tvtmd.exe updat upgrad utpost. webdav.exe win32.exe win32us.exe winactive.exe win-bugsfix.exe window.exe windows.exe wininetd.exe wininit.exe wininitx.exe winlogin.exe winmain.exe winnet.exe winppr32.exe winservn.exe winssk32.exe winstart.exe winstart001.exe wintsk32.exe winupdate.exe wkufind wnad.exe wupdater.exe wupdt.exe |
DoS attacks
The worm searches the victim machine for the file C:\Feedlist. If it detects this file, it will attempt to conduct a DoS attack on www.symantec.com and symantec.com by sending looped multiple GET requests.
Email-Worms spread via email. The worm sends a copy of itself as an attachment to an email message or a link to its file on a network resource (e.g. a URL to an infected file on a compromised website or a hacker-owned website).
In the first case, the worm code activates when the infected attachment is opened (launched). In the second case, the code is activated when the link to the infected file is opened. In both case, the result is the same: the worm code is activated.
Email-Worms use a range of methods to send infected emails. The most common are:
- using a direct connection to a SMTP server using the email directory built into the worm’s code
- using MS Outlook services
- using Windows MAPI functions.
Email-Worms use a number of different sources to find email addresses to which infected emails will be sent:
- the address book in MS Outlook
- a WAB address database
- .txt files stored on the hard drive: the worm can identify which strings in text files are email addresses
- emails in the inbox (some Email-Worms even “reply” to emails found in the inbox)
Many Email-Worms use more than one of the sources listed above. There are also other sources of email addresses, such as address books associated with web-based email services.
Email-Worm.
- Email-Worm.
Mydoom. g (Kaspersky Lab) - I-Worm.
Mydoom. g (Kaspersky Lab) - Virus:
W32/Mydoom. h@MM (McAfee) - Mal/Sality-D (Sophos)
- Worm.
Mydoom. H (ClamAV) - W32/Sality.
aa (Panda) - W32/Sality.
gen2 (FPROT) - Virus:
Win32/Sality. AU (MS(OneCare)) - Win32.
Sector. 21 (DrWeb) - Win32/Sality.
NBA virus (Nod32) - Win32.
Mydoom. G@mm (BitDef7) - I-Worm.
Mydoom. h (VirusBuster) - Win32:
Mydoom-H [Wrm] (AVAST) - Email-Worm.
Win32. Mydoom (Ikarus) - Win32/Sality (AVG)
- W32/Sality.
AT (AVIRA) - W32.
Sality. AE (NAV) - NseCheckFile2() returned 0x00010018 (Norman)
- [Suspicious] (Rising)
- I-Worm.
Mydoom. h (VirusBusterBeta)
© 1997-2012 Kaspersky Lab ZAO. All Rights Reserved.
Industry-leading Antivirus Software.
Registered trademarks and service marks are the property of their respective owners.