Win32.Mydoom.B@mm (Win32.Novarg.B@mm)( I-Worm.Mydoom.b, W32/Mydoom.b@MM, W32/MyDoom-B )
SYMPTOMS: The following files in the Windows System folder (%SYSDIR%):EXPLORER.EXE CTFMON.DLL The following registry key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run with the value: Explorer = %SYSDIR%\EXPLORER.EXE Activity on ports 1080 or 10080 and 3127. TECHNICAL DESCRIPTION: This is an internet worm that spreads trough e-mail and file sharing programs and has backdoor capabilities.It also tries to infect computers in the local network already infected by the former variant of the worm, by using the backdoor already installed on port 3127. The e-mail arrives in the following format: From: A random text or an address with one of the following domains:
Subject: Randomly chosen from the following list:
Body text: A random text or one of the following:
Attachment: A file with document icon and executable extension (pif, cmd, bat, scr, exe) with one of the following names:
The virus terminates the process TASKMON.EXE if it is running. It uses a mutex called sync-v1.01__ipcmtx0 to avoid multiple running instances. It 80% of cases it opens Notepad with a file with random data:  and in 20% of cases it shows a fake error message:  The backdoor is installed in the Windows System folder with the name CTFMON.DLL listening to one of the following ports: 1080, 3128, 80, 8080, 10080. After 1st of March 2004, the worm stops spreading, but the backdoor remains installed and listening. A copy of the virus named EXPLORER.EXE is created in the Windows System folder and the registry entry is created, so that Windows will load the worm each time: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run with the value: Explorer = %SYSDIR%\EXPLORER.EXE Also, the worm creates another registry key for the backdoor to load with Windows each time: HKEY_CLASSES_ROOT\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32 with the value: (default) = %SYSDIR%\CTFMON.DLL On Windows NT, 2000, XP or 2003, the hosts file (%SYSDIR%\drivers\etc\hosts) is modified so as the user won't be able to connect to the following hosts:
In 80% of cases, after February 1st, 2004 (13:09:18), the virus attempts to attack the website www.sco.com (using the main thread and 7 additional threads). Otherwise, in 70% of cases, after February 3rd, 2004 (16:09:18), the virus attempts to attack the website www.microsoft.com (using the main thread and 13 additional threads). Attack details:
However, as www.microsoft.com is one of the hosts that are prevented to be accessed (by modifying the Windows hosts file), it won't be attacked by the systems that run Windows NT, 2000, XP or 2003. It copies itself to the Kazaa shared folder under the following names, and an executable extension:
The worm searches for e-mails in files with one of these extensions:
First it searches the Temporary Internet Files for ensuring a fast initial spreading, and after that on all fixed drives it finds, skipping e-mail addresses that contains the following: abuse, accoun, certific, listserv, ntivi, icrosoft, admin, page, the.bat, gold-certs, feste, submit, help, service, privacy, somebody, soft, contact, site, rating, bugs, your, someone, anyone, nothing, nobody, noone, webmaster, postmaster, support, samples, info, root, ruslis, nodomai, mydomai, example, inpris, borlan, nai., sopho, foo., .mil, gov., .gov, panda, icrosof, syma, kasper, mozilla, utgers.ed, tanford.e, acketst, secur, isc.o, isi.e, ripe., arin., sendmail, rfc-ed, ietf, iana, usenet, fido, linux, kernel, google, ibm.com, fsf., mit.e, math, unix, berkeley, spam The worm contains the following string (never displayed): (sync-1.01; andy; I'm just doing my job, nothing personal, sorry) Removal instructions: Let BitDefender delete all files found infected by this worm.ANALYZED BY: Mihai Neagu, Bogdan Dragu BitDefender Virus Researchers |
Archives des bulletins d’informations
Suivez-nous ici : 
