Worm/MyDoom.F - Worm

See also

Full description

Alias:	I-Worm.Mydoom.F, W32/Mydoom.f@MM, W32/Mydoom.F.worm, W32/MyD
Type:	Worm
Size:	34.568 bytes
Origin:	unknown
Date:	02-20-2004
Damage:	Spreading over email and mapped network drives, performs a DOS attack, starts a backdoor routine
VDF Version:	6.24.00.12 - Fri, 20 Feb 2004 11:06 (GMT+1)
Danger:	Low
Distribution:	Medium

General DescriptionWorm/MyDoom spreads over by sending emails with infected attachments. When the worm is executed, a fake error message will appear. It copies itself with a random file name in the Windows system folder and creates a DLL file in the same location, also with a random file name. Furthermore it copies itself as a "zip" archive into different folders of the local or mapped drives, also with a random file name.

Symptoms* A fake error message appears, with the message: "file is corrupted"

Distribution* Sends itself via email using its own smtp engine
* Spreading over mapped network drives

Technical DetailsIf Worm/MyDoom.F is executed, then it copies itself as:

* %SystemDIR%\<random name>.exe

A DLL file with a random file name is also created:

* %SystemDIR%\<random name>.dll (8.068 bytes)

It copies itself as a "zip" archive into different folders on the local drives. Zip archives have sizes of 34,688 bytes and also have random file names.

Worm/MyDoom.F scans the local drives for files with the following extensions and deletes them: bmp, avi, jpg, sav, xls, doc, mdb.

The worm will scan all the files having the following extensions for email addresses, and will send itself to them, using a spoofed sender address:

* adb
* asp
* dbx
* eml
* hp
* htm
* mbx
* mht
* mmf
* msg
* nch
* ods
* often
* pl
* rtf
* sht
* tbb
* txt
* uin
* vbs
* wab

The worm uses its own smtp engine, making it independent of the email client. Emails generated by Worm/MyDoom.F can have different appearances:

Subject:

* (Blank)
* Announcement
* ApprovedNews
* Attention
* automatic responder
* Bug
* Current Status
* EXPIRED ACCOUNT
* For your information
* hello
* hi
* hi, it's me
* IMPORTANT
* Information Warning
* Love is Love is...
* Please read
* Please reply
* Re:
* Re: Approved
* Re: Thank You
* Read it immediately
* read now!
* Read this
* Readme
* Recent news
* Recent news
* Something for you
* Undeliverable message
* Unknown
* You have 1 day left
* You use illegal File Sharing... Your IP was logged
* Your account is about to be expired
* Your credit card
* Your order is being processed
* Your order was registered
* Your request is being processed
* Your request was registered

Body:

* Check the attached document.
* Details are in the attached document. You need Microsoft Office to open it.
* Greetings
* Here is the document.
* Here it is
* I have your password :)
* I wait for your reply.
* I wait for your reply.
* I'm waiting
* I'm waiting Okay
* Information about you
* Is that from you?
* Is that yours?
* Kill the writer of this document!
* OK Everything ok?
* Please see the attached file for details
* Please, reply
* Read the details.
* Reply
* See the attached file for details
* See you
* See you Here it is
* Something about you
* Take it
* The document was sent in compressed format.
* We have received this document from your e-mail.
* You are a bad writer
* You are bad

Attachment:

* <random name>.zip

Worm/MyDoom.F contains a backdoor component, which listen at TCP port 1080 of the infected machine for instructions.

Worm/MyDoom.F will also start a DoS (Denial of Service) attack against:

* www.microsoft.com
* www.riaa.com

See a brief description here.

Description inserted by Crony Walker on Tue, 15 Jun 2004 14:00 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back