Need help? Ask the community or hire an expert.
Go to Avira Answers
??:Worm/Mydoom.CD
????:13/12/2012
??:??
????:?
????????????
??/?????????????
?? / ?????????
????:?
????:28.160 ??
MD5 ???:eda0ab20b95a3722b04101490D340E20
VDF ??:7.11.53.216

 ???? ????:
   • ????
   • ????


??:
   •  Kaspersky: Email-Worm.Win32.Gurong.a
   •  TrendMicro: WORM_MYDOOM.BK

???????:
     Worm/Mydoom.CD.2


??/????:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003


???:
   • ??????
   • ???????????
   • ?????

 ?? ???????????:
   • %SYSDIR%\wmedia16.exe



???????????????



??????:

– ??????????:
   • %TEMPDIR%\removeMe%??%.bat
   • %TEMPDIR%\tmp%?????%.tmp




????????:

????????:
   • 65.19.**********
   • 64.62.**********
???????????????: c:\mp.exe ???????? ?????????????????? ???: Worm/Mydoom.CD.1

 ??? ????????????????????????:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • WMedia16 = wmedia16.exe

 ???? ?????? SMTP ???????????? ?????????????? ?????????:


???:
?????????
???????? ???????????????????????? ??????????????????????????? ???????????????????????????? ??????????


???:
– ????????????????????
– ???????


??:
??????:
   • Re: I got it! Try it now!
   • Re[2]: wazzup bro
   • Re: Hello
   • Greetings!
   • Hey dear!
   • Hello friend ;)
   • Wazzap bro!!
   • Hey! How are you doing bud?

????????????????
???????????


??:
??????????????
?????????????????
??????????????:
   • Hey dear! Here is my photos, as I promised.
   • Hello bro! Here is my new girlfriend's photo! Check it out!
   • Hey man! Take a look at attachment!
   • Hello buddy! Take a look at attachment! Here is my nude 17-yr sister!
   • Whatz up man! There is my nude 17-yr sister in the attachment!
   • Greetings! Check out my portfolio, please! Here is some my photos in the archive.
   • Greetings. Here is some my nude photos in the attachment.
   • Hey bro! Check out attachment! There is a new plug-in for skype!
   • Hello! I sent you new skype plug-in, as you wished.
   • Hello! There is NEW plug-in for MSN. Try it out!
   • Hello! Here is NEW smiles pack for MSN messenger! It is really cool ;)
   • Hey friend! Try this new smiles pack for MSN messenger!


??:
????????????:

–  ??????????:
   • body
   • i_love_u
   • i_luv_u
   • conf_data
   • port_imgs
   • sex_pics
   • doc
   • sex_girls
   • document
   • %?????%

    ?????????????:
   • .bat
   • .cmd
   • .exe
   • .pif
   • .scr
   • .zip



??????????:



 ?? ????:
????????????????:
   • txt
   • htm
   • sht
   • php
   • asp
   • dbx
   • tbb
   • adb
   • wab


? TO (???) ? FROM (???) ??????:
????????????????:
   • john; john; alex; michael; james; mike; kevin; david; george; sam;
      andrew; jose; sandra; den; dmitry; vlad; alexey; olga; leo; maria;
      jim; brian; serg; mary; ray; tom; peter; robert; bob; jane; linda;
      craig; jayson; lee; cyber; frank; joe; dan; dave; matt; steve; smith;
      adam; brent; alice; anna; brenda; claudia; debby; helen; jerry; jimmy;
      julie; linda; marina; vladimir; nikolay; gerhard; ilya; boris

?????????????????????????????????????????????

????????:
   • yahoo.com
   • msn.com
   • earthlink.net
   • aol.com
   • hotmail.com


????:
??????????????????????:
   • .aero; foo.; .mil; gov.; .gov; ruslis; nodomai; mydomai; example;
      inpris; borlan; sopho; panda; hotmail; msn.; icrosof; syma; avp;
      mozilla; utgers.ed; tanford.e; pgp; acketst; secur; isc.o; isi.e;
      ripe.; arin.; sendmail; rfc-ed; ietf; iana; usenet; fido; linux;
      kernel; google; ibm.com; fsf.; gnu; mit.e; bsd; math; unix; berkeley;
      alert; page; the.bat; fethard; gold-certs; feste; submit; not; help;
      service; privacy; somebody; soft; contact; site; rating; bugs; you;
      your; someone; AccountRobot; anyone; nothing; nobody; noone;
      webmaster; webmoney; postmaster; samples; info; root; fraud; accoun;
      google; certific; listserv; linux; bsd; unix; ntivi; support;
      icrosoft; admin; spm; fcnz; www; secur; abuse; .edu;


???? MX ???:
???????????? IP ?????????????????:
   • mx.
   • mail.
   • smtp.
   • mx1.
   • mxs.
   • mail1.
   • relay.
   • ns.
   • gate.

 P2P ????????????????????????:


   ????????????????????:
   • HCKU\Software\Kazaa\Transfer\DlDir0

   ????????????:
   • winamp5.bat; icq5.bat; xp_activation.bat; strip-girl4.bat0c.bat;
      dcom_patches.bat; lsas_patches.bat; msblast_patches.bat;
      skype_video.bat; 0day_patch.bat; office_crack.bat;
      trillian_crack_all.bat; winamp5.cmd; icq5.cmd; xp_activation.cmd;
      strip-girl4.cmd0c.cmd; dcom_patches.cmd; lsas_patches.cmd;
      msblast_patches.cmd; skype_video.cmd; 0day_patch.cmd;
      office_crack.cmd; trillian_crack_all.cmd; winamp5.exe; icq5.exe;
      xp_activation.exe; strip-girl4.exe0c.exe; dcom_patches.exe;
      lsas_patches.exe; msblast_patches.exe; skype_video.exe;
      0day_patch.exe; office_crack.exe; trillian_crack_all.exe; winamp5.pif;
      icq5.pif; xp_activation.pif; strip-girl4.pif0c.pif; dcom_patches.pif;
      lsas_patches.pif; msblast_patches.pif; skype_video.pif;
      0day_patch.pif; office_crack.pif; trillian_crack_all.pif; winamp5.scr;
      icq5.scr; xp_activation.scr; strip-girl4.scr0c.scr; dcom_patches.scr;
      lsas_patches.scr; msblast_patches.scr; skype_video.scr;
      0day_patch.scr; office_crack.scr; trillian_crack_all.scr; winamp5.zip;
      icq5.zip; xp_activation.zip; strip-girl4.zip0c.zip; dcom_patches.zip;
      lsas_patches.zip; msblast_patches.zip; skype_video.zip;
      0day_patch.zip; office_crack.zip; trillian_crack_all.zip

   ???????????????

 ?? ?????:


??????????? Internet ??:
   • http://windowsupdate.microsoft.com


Mutex:
?????? Mutex:
   • systemHNDLR9r21

 Rootkit ?? ????????????? ????????????????????????????????????????


??????:
– ??????
– ??????
– ????????


?????:
     ? Windows API ??

???? API ?? :
   • NtClose/ZwClose
   • NtCreateFile/ZwCreateFile
   • NtEnumerateKey/ZwEnumerateKey
   • NtEnumerateValueKey/ZwEnumerateValueKEy
   • NtOpenFile/ZWOpenFile
   • NtQueryDirectoryFile/ZwQueryDirectoryFile

 ?????? ????:
????????? MS Visual C++ ????


???????:
????????????????????????????????:
   • UPX

Açıklamayı yerleştiren Andrei Gherman tarihinde 22 Mart 2006 Çarşamba
Açıklamayı güncelleyen: Andrei Gherman tarihinde 30 Mart 2006 Perşembe

Geri . . . .
https:// Bu pencere güvenlik amacıyla şifrelenmiştir.