My Bitdefender
  • 0 Shopping Cart

SHARE
THIS ON

Facebook Twitter Google Plus

Win32.Mydoom.B@mm (Win32.Novarg.B@mm)

LOW
MEDIUM
29184 bytes, 5632 bytes
(I-Worm.Mydoom.b, W32/Mydoom.b@MM, W32/MyDoom-B)

Symptoms

The following files in the Windows System folder (%SYSDIR%):
EXPLORER.EXE
CTFMON.DLL


The following registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
with the value:
Explorer = %SYSDIR%\EXPLORER.EXE

Activity on ports 1080 or 10080 and 3127.

Removal instructions:

Let BitDefender delete all files found infected by this worm.

Analyzed By

Mihai Neagu, Bogdan Dragu BitDefender Virus Researchers

Technical Description:

This is an internet worm that spreads trough e-mail and file sharing programs and has backdoor capabilities.

It also tries to infect computers in the local network already infected by the former variant of the worm, by using the backdoor already installed on port 3127.

The e-mail arrives in the following format:

From:
A random text or an address with one of the following domains:
  • aol.com
  • msn.com
  • yahoo.com
  • hotmail.com

Subject:
Randomly chosen from the following list:
  • Mail Transaction Failed
  • Unable to deliver the message
  • Status
  • Delivery Error
  • Mail Delivery System
  • hello
  • Error
  • Server Report
  • Returned mail

Body text:
A random text or one of the following:
  • test
  • The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.
  • sendmail daemon reported: Error #804 occured during SMTP session. Partial message has been received.
  • The message contains Unicode characters and has been sent as a binary attachment.
  • The message contains MIME-encoded graphics and has been sent as a binary attachment.
  • Mail transaction failed. Partial message is available.

Attachment:
A file with document icon and executable extension (pif, cmd, bat, scr, exe) with one of the following names:
  • body
  • doc
  • text
  • document
  • data
  • file
  • readme
  • message

The virus terminates the process TASKMON.EXE if it is running.

It uses a mutex called sync-v1.01__ipcmtx0 to avoid multiple running instances.

It 80% of cases it opens Notepad with a file with random data:



and in 20% of cases it shows a fake error message:




The backdoor is installed in the Windows System folder with the name CTFMON.DLL listening to one of the following ports: 1080, 3128, 80, 8080, 10080.

After 1st of March 2004, the worm stops spreading, but the backdoor remains installed and listening.

A copy of the virus named EXPLORER.EXE is created in the Windows System folder and the registry entry is created, so that Windows will load the worm each time:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
with the value:
Explorer = %SYSDIR%\EXPLORER.EXE

Also, the worm creates another registry key for the backdoor to load with Windows each time:

HKEY_CLASSES_ROOT\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32
with the value:
(default) = %SYSDIR%\CTFMON.DLL

On Windows NT, 2000, XP or 2003, the hosts file (%SYSDIR%\drivers\etc\hosts) is modified so as the user won't be able to connect to the following hosts:

  • engine.awaps.net
  • awaps.net
  • www.awaps.net
  • ad.doubleclick.net
  • spd.atdmt.com
  • atdmt.com
  • click.atdmt.com
  • clicks.atdmt.com
  • media.fastclick.net
  • fastclick.net
  • www.fastclick.net
  • ad.fastclick.net
  • ads.fastclick.net
  • banner.fastclick.net
  • banners.fastclick.net
  • www.sophos.com
  • sophos.com
  • ftp.sophos.com
  • f-secure.com
  • www.f-secure.com
  • ftp.f-secure.com
  • securityresponse.symantec.com
  • www.symantec.com
  • symantec.com
  • service1.symantec.com
  • liveupdate.symantec.com
  • update.symantec.com
  • updates.symantec.com
  • support.microsoft.com
  • downloads.microsoft.com
  • download.microsoft.com
  • windowsupdate.microsoft.com
  • office.microsoft.com
  • msdn.microsoft.com
  • go.microsoft.com
  • nai.com
  • www.nai.com
  • vil.nai.com
  • secure.nai.com
  • www.networkassociates.com
  • networkassociates.com
  • avp.ru
  • www.avp.ru
  • www.kaspersky.ru
  • www.viruslist.ru
  • viruslist.ru
  • avp.ch
  • www.avp.ch
  • www.avp.com
  • avp.com
  • us.mcafee.com
  • mcafee.com
  • www.mcafee.com
  • dispatch.mcafee.com
  • download.mcafee.com
  • mast.mcafee.com
  • www.trendmicro.com
  • www3.ca.com
  • ca.com
  • www.ca.com
  • www.my-etrust.com
  • my-etrust.com
  • ar.atwola.com
  • phx.corporate-ir.net
  • www.microsoft.com

In 80% of cases, after February 1st, 2004 (13:09:18), the virus attempts to attack the website www.sco.com (using the main thread and 7 additional threads).

Otherwise, in 70% of cases, after February 3rd, 2004 (16:09:18), the virus attempts to attack the website www.microsoft.com (using the main thread and 13 additional threads).

Attack details:
  • the threads attempt to get the home page of those sites by sending a HTTP GET command
  • the priority of the threads is set to "below normal"
  • once the main thread sends the request, the virus loops (recreates the other threads, etc).

However, as www.microsoft.com is one of the hosts that are prevented to be accessed (by modifying the Windows hosts file), it won't be attacked by the systems that run Windows NT, 2000, XP or 2003.

It copies itself to the Kazaa shared folder under the following names, and an executable extension:

  • NessusScan_pro
  • attackXP-1.26
  • winamp5
  • MS04-01_hotfix
  • zapSetup_40_148
  • BlackIce_Firewall_Enterpriseactivation_crack
  • xsharez_scanner
  • icq2004-final

The worm searches for e-mails in files with one of these extensions:
  • .adb
  • .asp
  • .dbx
  • .htm
  • .php
  • .pl
  • .sht
  • .tbb
  • .txt
  • .wab

First it searches the Temporary Internet Files for ensuring a fast initial spreading, and after that on all fixed drives it finds, skipping e-mail addresses that contains the following:

abuse, accoun, certific, listserv, ntivi, icrosoft, admin, page, the.bat, gold-certs, feste, submit, help, service, privacy, somebody, soft, contact, site, rating, bugs, your, someone, anyone, nothing, nobody, noone, webmaster, postmaster, support, samples, info, root, ruslis, nodomai, mydomai, example, inpris, borlan, nai., sopho, foo., .mil, gov., .gov, panda, icrosof, syma, kasper, mozilla, utgers.ed, tanford.e, acketst, secur, isc.o, isi.e, ripe., arin., sendmail, rfc-ed, ietf, iana, usenet, fido, linux, kernel, google, ibm.com, fsf., mit.e, math, unix, berkeley, spam

The worm contains the following string (never displayed):
(sync-1.01; andy; I'm just doing my job, nothing personal, sorry)