Worm/MyDoom - Worm

Siehe auch

Vollständig

Alias:	W32/Novarg@mm, Shimgapi
Type:	Worm
Size:	22,528 bytes
Origin:	Russia
Date:	01-26-2004
Damage:	Spreads itself by email and P2P network KaZaA, starts a DoS attack, backdoor routine
VDF Version:	6.23.0.47
Danger:	Low
Distribution:	High

General DescriptionWorm/MyDoom spreads itself by email or over P2P network KaZaA. The worm creates the file named "SHIMGAPI.DLL" in Windows system. This contains a backdoor component which enables potential attackers to take over the computer over the TCP ports 3127 to 3198. Worm/MyDoom starts the DoS attack on the SCO.COM web-site on February 1st.

Symptoms* Windows Notepad.exe is opened, with binary trash
* The data Shimgapi.dll can be seen in Windows system.

Distribution* Sends itself by email, using its own SMTP engine;
* Spreads over P2P network KaZaA, by shared directories.

Technical DetailsWhen the worm is active, it creates the following files:
* \%WinDIR%\%SystemDIR%\Shimgapi.dll
* \%WinDIR%\%SystemDIR%\Taskmon.exe
* \%WinDIR%\%Temp%\Message.

If a file with the name Taskmon.exe can be found, this worm will overwrite it.
The file SHIMGAPI.DLL will be loaded by EXPLORER.EXE. The following registry entry will be modified like bellow:

* [HKEY_CLASSES_ROOT\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\
InProcServer32]
@="C:\\%WinDIR%\\%SystemDIR%\\shimgapi.dll"

Also, the following registry entry is made, so that the worm can be activated on the next system start:
* [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run]
"TaskMon"="C:\\%WinDIR%\\%SystemDIR%\\taskmon.exe"

or

* [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run]
"TaskMon"="C:\\%WinDIR%\\%SystemDIR%\\taskmon.exe"

The worm copies itself in the download directory of the P2P network program
KaZaA with the following filenames:
* activation_crack
* icq2004_final
* nuke2004
* office_crack
* rootkitXP
* strip-girl-2.0bdcom_patches
* winamp5
and use these extensions: .pif, .scr, .bat or .exe.

For email spreading, the Worm/MyDoom.B searches for email addresses, on the local workstations, in all the files with the following extensions:
* .htm
* .sht
* .wab
* .txt
* .php
* .asp
* .dbx
* .tbb
* .adb
* .pl

The worm has its own SMTP engine, which allows it to send emails without an email client (for example Outlook). A Worm/MyDoom email can have different appearance:

Subject:
* Error
* hello
* hi
* Mail Delivery System
* Mail Transaction Failed
* test
* Server Report
* Status

Body:
* Mail transaction failed. Partial message is available
* The message conatins Unicode characters and has been sent as a binary
attachment
* The message cannont be represented in 7-bit ASCII encoding and has been send
as a binary attachment

Attachment:
* body
* data
* document
* doc
* file
* message
* text
* test
* readme

The attachment has one of the following extensions, chosen by the worm: .pif, .scr, .exe, .cmd, .zip, .bat.

The worm contains a backdoor component. This is included in SHIMGAPI.DLL. With the help of this component the potential attackers can take control over the infected computer over TCP ports 3127 to 3198.

Worm/MyDoom starts a DoS (Denial-of-Service) attack on February 1st. Every
second, it initiates an enquiery on the main site of SCO.COM.

Manual Remove Instructions- for Windows 2000/XP:
In order to remove the virus by hand, you should be in Safe Mode first. Press the F8 key when you start your computer, and select the 'safe mode' option that will appear.

Delete the following files:
* \%WinDIR%\%SystemDIR%\Shimgapi.dll
* \%WinDIR%\%SystemDIR%\Taskmon.exe
* \%WinDIR%\%Temp%\Message.
* \%My Shared Folder%\activation_crack.*
* \%My Shared Folder%\icq2004_final.*
* \%My Shared Folder%\nuke2004.*
* \%My Shared Folder%\office_crack.*
* \%My Shared Folder%\rootkitXP.*
* \%My Shared Folder%\strip-girl-2.0bdcom_patches.*
* \%My Shared Folder%\winamp5.*

Start "regedit" after that and delete the following registry entries:

* [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run]
"TaskMon"="C:\\%WinDIR%\\%SystemDIR%\\taskmon.exe"

* [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run]
"TaskMon"="C:\\%WinDIR%\\%SystemDIR%\\taskmon.exe"

* [HKEY_CLASSES_ROOT\CLSID\{E6FB5E20-DE35-11CF-9C87-
00AA005127ED}\InProcServer32]
@="C:\\%WinDIR%\\%SystemDIR%\\shimgapi.dll"

Restart your computer.

- for Windows 9x/Me:
In order to remove the virus by hand, you should be in Safe Mode first. Press the F8 key when you start your computer, and select the 'safe mode' option that will appear.

Delete the following files:

* \%WinDIR%\%SystemDIR%\Shimgapi.dll
* \%WinDIR%\%SystemDIR%\Taskmon.exe
* \%WinDIR%\%Temp%\Message.
* \%My Shared Folder%\activation_crack.*
* \%My Shared Folder%\icq2004_final.*
* \%My Shared Folder%\nuke2004.*
* \%My Shared Folder%\office_crack.*
* \%My Shared Folder%\rootkitXP.*
* \%My Shared Folder%\strip-girl-2.0bdcom_patches.*
* \%My Shared Folder%\winamp5.*

Start "regedit" after that and delete the following registry entries:

* [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run]
"TaskMon"="C:\\%WinDIR%\\%SystemDIR%\\taskmon.exe"

* [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run]
"TaskMon"="C:\\%WinDIR%\\%SystemDIR%\\taskmon.exe"

* [HKEY_CLASSES_ROOT\CLSID\{E6FB5E20-DE35-11CF-9C87-
00AA005127ED}\InProcServer32]
@="C:\\%WinDIR%\\%SystemDIR%\\shimgapi.dll"

Restart your computer.

Kurzfassung hier.

Beschreibung erstellt von Crony Walker am Tue, 15 Jun 2004 14:00 (GMT+1)

» Über Malware
» Über Phishing
» In-the-Wild-Viren

« zurück