Virus Characteristics
-- Update March 11, 2004 --
The risk assessment of this threat was lowered to Low-Profiled due to a decrease in prevalence.
-- Update February 23rd, 2004 --
The risk assessment of this threat has been raised to Medium due to increased prevalence.
Mydoom only infects systems running Microsoft Windows.
If you think that you may be infected with Mydoom, and are unsure how to check your system, you may
download the Stinger tool
to scan your system and remove the virus if present. This is not required for McAfee users as McAfee products are capable of detecting and removing the virus with the latest update. (see the removal instructions below for more information).
Note:
Receiving an email alert stating that the virus came from your email address is not
an indication that you are infected as the virus often forges the from address.
|
This is a mass-mailing and share-hopping worm that bears the following characteristics:
- contains its own SMTP engine to construct outgoing messages
- contains ability to copy itself to mapped drives
- contains a backdoor component
- contains a Denial of Service payload
- contains payload of deleting files
The virus arrives in an email message as follows:
From:
(Spoofed email sender)
Do not assume that the sender address is an indication that the sender is infected. Additionally you may receive alert messages from a mail server that you are infected, which may not be the case
Subject:
(Varies, such as)
- (Blank)
- Announcement
- ApprovedNews
- Attention
- automatic responder
- Bug
- Current Status
- EXPIRED ACCOUNT
- For your information
- hello
- hi, it's me
- hi
- IMPORTANT
- Information Warning
- Love is Love is...
- Please read
- Please reply
- Re: Approved
- Re: Thank You
- Re:
- Read it immediately
- read now!
- Read this
- Readme
- Recent news
- Recent news
- Something for you
- Undeliverable message
- Unknown
- You have 1 day left
- You use illegal File Sharing...
- Your IP was logged
- Your account is about to be expired
- Your credit card
- Your order is being processed
- Your order was registered
- Your request is being processed
- Your request was registered
Body:
(Varies, such as)
- Check the attached document.
- Details are in the attached document. You need Microsoft Office to open it.
- Greetings
- Here is the document.
- Here it is
- I have your password :)
- I wait for your reply.
- I wait for your reply.
- I'm waiting Okay
- I'm waiting
- Information about you
- Is that from you?
- Is that yours?
- Kill the writer of this document!
- OK Everything ok?
- Please see the attached file for details
- Please, reply
- Read the details.
- Reply
- See the attached file for details
- See you Here it is
- See you
- Something about you
- Take it
- The document was sent in compressed format.
- We have received this document from your e-mail.
- You are a bad writer
- You are bad
Attachment:
(Varies [.cmd, .bat, .pif, .com, .scr, .exe] - often arrives in a zip archive)
- creditcard.bat
- creditcard.zip
- details.zip
- mail.zip
- notes.zip
- part1.zip
- paypal.zip
- photo.zip
- textfile.zip
- vpf.zip
- website.zip
- %random characters%.zip
The icon used by the file tries to make it appear as if the attachment is a text file:
When this file is run (manually), it copies itself to the WINDOWS SYSTEM directory using random filenames (Eg: hiruszomrk.exe)
(Where %SYSDIR% is the Windows System directory, for example C:\windows\system)
It creates the following registry entry to hook the Windows startup, inserting the previously generated filename:
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Run "nhch" = %SYSDIR%\hiruszomrk.exe
- HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run "nhch" = %SYSDIR%\hiruszomrk.exe
Note: the key "nhch" is also randomly generated.
The virus also uses a DLL that it creates in the Windows System directory using random filenames (Eg: vppu.dll):
- %SYSDIR%\vppu.dll (8,068 bytes)
The worm enumerates the current running processes. It attempts to shut down processes with the following names:
- avp.
- avp32
- intrena
- mcafe
- navapw
- navw3
- norton
- reged
- taskmg
- taskmo
Shared drives propagation
The worm makes copies of itself as .zip archives or .exe in different directories on local and mapped drives. The filenames are random alphabetical names and are 34 Kbytes in size.
The worm searches local and mapped drives to delete a percentage of files with the following extensions: [*.bmp*, *.avi*, *.jpg*, *.sav*, *.xls*, *.doc*, *.mdb*]
Remote Access Component
The worm listens on port 1080 on the infected machine. It also opens a list of other ports. The range of ports are from 3000 ~ 5000.
Denial of Service Component
If the system date is between 17th and 22nd of any month, the worm will perform a denial of service attack against the following websites:
- www.microsoft.com
- www.riaa.com
The denial of service executes by creating random number of threads each of which makes a HTTP GET request from random ports on the infected machines to port 80 of the target sites.