Tr/Mydoom.BB.1 - Trojan

See also

Summary

Full description

Statistics

Virus:	Tr/Mydoom.BB.1
Date discovered:	23/05/2006
Type:	Trojan
In the wild:	Yes
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Medium
Static file:	Yes
File size:	8.192 Bytes
MD5 checksum:	b0fe74719b1b647e2056641931907f4a
VDF version:	6.34.01.125 - Tue, 23 May 2006 12:39 (GMT+1)
IVDF version:	6.34.01.130 - Wed, 24 May 2006 06:39 (GMT+1)

General Method of propagation:
   • No own spreading routine

Alias:
   • Symantec: Backdoor.Zincite.A
   • Mcafee: W32/Mydoom.o@MM
   • Kaspersky: Email-Worm.Win32.Mydoom.m
   • TrendMicro: WORM_MYDOOM.M
   • Sophos: W32/MyDoom-O
   • Grisoft: I-Worm/Mydoom.O
   • VirusBuster: Backdoor.Mydoom.R
   • Eset: Win32/Mydoom.R
   • Bitdefender: Win32.Mydoom.M@mm

It was previously detected as:
   • Worm/Mydoom.BB.1

Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Registry modification
   • Third party control

Files The following files are created:

– Temporary files that might be deleted afterwards:
• %TEMPDIR%\zincite.log
• %TEMPDIR%\yzptj.log

Registry The following registry key is added in order to run the process after reboot:

– HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• "Services"=" %malware execution directory%\%executed file%"

Backdoor The following port is opened:

– %malware execution directory%\%executed file% on TCP port 1034 in order to provide backdoor capabilities.

File details Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
• UPX

See a brief description here.

Description inserted by Irina Boldea on Thu, 18 May 2006 12:04 (GMT+1)
Description updated by Irina Boldea on Mon, 29 May 2006 16:20 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back