I-Worm.Mydoom.b
From; Kaspersky http://www.viruslist.com/eng/viruslist.html?id=850737 Mydoom.b is a modification of Mydoom.a that spreads via the Internet in the form of files attached to infected messages and via the Kazaa file-sharing network. The worm itself is a Windows PE EXE file of 29184 bytes, compressed using UPX and PE-Patch. The decompressed file is approximately 49KB in size. The worm is activated only if the user opens the archive and launches the infected file by double-clicking on the attachment. The worm then installs itself in the system and starts the replication process. The worm contains a backdoor function, and is also programmed to carry out DoS attacks on the sites www.sco.com and www.microsoft.com. Part of the body of the worm is encrypted. The unpacked file contains the following text: (sync-1.01; andy; I'm just doing my job, nothing personal, sorry) InstallationFollowing launch, the worm opens Windows Notepad, showing a random selection of symbols:During installation, the worm copies itself under the name explorer.exe to the Windows system directory, and registers this file in the system registry auto-run key: [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "TaskMon" = "%System%\explorer.exe"The worm creates the file ctfmon.dll,/i> in the Windows system directory which is a backdoor component (a proxy server) and also registers this in the system registry: [HKCR\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32]
"Apartment" = "%SysDir%\ctfmon.dll"
Ctfmon.dll will therefore launch as a procedure linked to Explorer.exe.
The worm also creates a file called Body,/i> in the temporary directory (usually in %windir%\temp). This file contains a random selection of symbols. So that the worm can identify itself in the system, it creates several additional keys in the system registry: [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\Version] [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\Version]While running it also creates a unique identifier sync-v1.01__ipcmtx0. Mydoom.b replaces the standard file 'hosts' in the Windows directory into with its own version (under the same name). This file will now prevent user access to the following domains:
Mailing lettersEmails are sent in the same way that Mydoom.a uses except for the following changes.The body text is chosen at random from the following: The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment sendmail daemon reported: Error #804 occured during SMTP session. Partial message has been received The message contains Unicode characters and has been sent asa binary attachment. The message contains MIME-encoded graphics and has been sent as a binary attachment Mail transaction failed. Partial message is available.Mydoom.b might also send emails with random strings of characters in the subject, body and attachment name. Propagation via P2PThe worm checks for the presence of a Kazaa client on the computer and copies itself to the file-sharing directory under the following names:NessusScan_pro attackXP-1.26 winamp5 MS04-01_hotfix zapSetup_40_148 BlackIce_Firewall_Enterpriseactivation_crack xsharez_scanner icq2004-finalwith the following extensions: bat exe scr pif Kaspersky's CLRAV remover; CLRAV scans the computer memory and hard drive of the infected machine, neutralizes the worm and restores the original configuration of the Windows system registry. Additionally, this removal tool copes effectively with other malicious programs, including Klez, Lentin, Opasoft, Tanatos, Welchia, Sobif, Dumaru and Swen. Given the current outbreak, CLRAV is most useful for users, who have installed anti-virus protection that does not detect and delete Mydoom correctly. Kaspersky Labs recommends that users close all active applications before launching CLRAV. Once the utility is installed, the machine must be restarted. Finally, it is best to launch an anti-virus scanner to perform a comprehensive virus check. You can download CLRAV from ftp://ftp.kaspersky.com/utils/clrav.zip |
See also;
Computer Associates; http://www3.ca.com/virusinfo/virus.aspx?ID=38114
Microsoft; https://information.microsoft.com/security/antivirus/mydoom.asp
Sophos: http://www.sophos.com/virusinfo/analyses/w32mydoomb.html
Symantec: http://securityresponse.symantec.com/avcenter/venc/data/w32.novarg.b@mm.html
US CERT Technical Alert TA04-028A; http://www.us-cert.gov/cas/techalerts/TA04-028A.html
Zone Alarm can "Lock host file" to prevent changes there;
http://download.zonelabs.com/bin/free/securityAlert/6.html