Alias:W32/Mydoom.gen
Type:Worm 
Size:10.801 bytes 
Origin: 
Date:12-15-2004 
Damage: 
VDF Version:6.29.00.16 
Danger:Low 
Distribution:Medium 

General DescriptionAffected platforms:
- Windows 95
- Windows 98
- Windows ME
- Windows NT
- Windows 2000
- Windows XP
- Windows Server 2003

SymptomsDamage routine: email sending

DistributionWorm/Atak.J disposes of its own SMTP engine. One of the emails sent by the worm can have the following appearance:

-Subject: (one of the following)

HAPPY NEW YEAR!
MERRY X-MAS!
Merry X-Mas!
Happy New Year!

-Body: (one of the following)

Happy New year and wish you good luck on next year!
Mery Chrismas & Happy New Year! 2005 will be the beginning!

-Attachment: (one of the following)

com.zip
scr.zip
pif.zip
bat.zip
scr.com
bat.pif
bat.scr
scr.bat
pif.scr
com.scr
com.pif
com.com
pif.bat

Technical DetailsWorm/Atak.J is one of the three versions of the Atak worm, that within a period of one hour were souhgt 'in the wild'. Both other versions of the worm Atak (.H and .I) which behave very similarly, were packed with the FSG runtime packer.
When Worm/Atak.J is executed, it copies itself with the filename "DEC25.EXE" in the Windows system directory and creates the following registry entries:

-[HKEY_CURRENT_USER\Software\Microsoft\ Windows NT\CurrentVersion\Windows]
"run"="C:\\WINDOWS\\System32\\dec25.exe"

The worm Atak is also able to append an autorun entry to the WIN.INI file.

The worm searches for email addresses within files with the following extensions:

.log
.html
.msg
.eml
.mht
.dbx
.asp
.php
.jsp
.htm
.txt
Description inserted by Crony Walker on Tuesday, June 15, 2004

Back . . . .