YOU’RE NOT VIEWING PANDA SECURITY USA. CLICK TO IMPROVE YOUR EXPERIENCE
VISIT PANDA SECURITY USA

Hello!

You’re about to visit our web page in English
Would you like to continue?

Yes, I want to visit the web page in English No, I want to visit the web page in

If this is not what you’re looking for,

Visit our Welcome Page!

x
48-HOUR OFFER
50%
RENEWALS
Home users only
RENEW AT A DISCOUNT
x
SPECIAL OFFER
If you're already a customer of
our homeusers protection,
renew now with 50% off
RENEW NOW
x
HALLOWEEN OFFER
take advantage of our
terrific discounts
BUY NOW AND GET 50% OFF
x
SPECIAL OFFER
Buy the best antivirus
at the best price
BUY NOW AND GET 50% OFF
x
SPECIAL OFFER
Buy the best antivirus
at the best price
BUY NOW AND GET 50% OFF
x
SPECIAL OFFER
Buy the best antivirus
at the best price
BUY NOW AND GET 50% OFF
x
UP TO
-60%
BUY NOW
x
UP TO
-60%
BUY NOW
Active Scan. Scan your PC free

Virus Encyclopedia

Welcome to the Virus Encyclopedia of Panda Security.

Mydoom.A

Threat LevelHigh threatDamageSevereDistributionNot widespread

Effects 

Mydoom.A carries out the following actions:

  • It launches DDoS (Distributed Denial of Service) attacks against the website www.sco.com if the system date is between February 1 and February 12, 2004. It does this by launching GET/ HTTP/ 1.1 requests every 1,024 milliseconds.
  • On February 12, 2004, the worm finishes its payload, ending its execution whenever it is activated.
  • It allows a hacker to gain remote access to network resources, as it drops the DLL (Dynamic Link Library) SHIMGAPI.DLL, which creates a backdoor, opening the first available TCP port in the range from 3127 to 3198. This backdoor component allows to download and run an executable file, and acts as a TCP proxy server.
  • It opens the Windows Notepad and shows junk data.

Note: on February 10, 2004, a new variant of this worm was detected by PandaLabs. This new variant carries out the same actions as the original, but it is compressed with Petite rather than with UPX.

Infection strategy 

Mydoom.A creates the following files in the Windows system directory:

  • TASKMON.EXE. This file is a copy of the worm.
  • SHIMGAPI.DLL. This file creates a backdoor, opening the first available TCP port in the range from 3127 to 3198.
  • MESSAGE in the Windows temporary directory. This file contains the text shown in Notepad the first time the worm activates.

Mydoom.A creates the following entries in the Windows Registry:

  • HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\ CurrentVersion\ Run
    TaskMon = %sysdir%\taskmon.exe

    where %sysdir% is the Windows system directory. By default, in Windows Me/98/95 computers, this directory is C:\ WINDOWS\ SYSTEM, whereas in Windows 2003/XP/2000/NT computers, it is C:\ WINNT\ SYSTEM32.
    By creating this entry, Mydoom.A ensures that it is run whenever Windows is started.
    If it is unable to create this entry, it creates the following one:

    HKEY_CURRENT_USER\ Software\ Microsoft\ Windows\ CurrentVersion\ Run
    TaskMon = %sysdir%\ taskmon.exe
  • HKEY_CLASSES_ROOT\ CLSID\ {E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ InProcServer
    (default) = %sysdir%\ SHIMGAPI.DLL

    By creating this entry, Mydoom.A launches the file SHIMGAPI.DLL with Windows Explorer.
  • HKEY_CURRENT_USER\ Software\ Microsoft\ Windows\ CurrentVersion\ Explorer\ ComDlg32
    HKEY_CURRENT_USER\ Software\ Microsoft\ Windows\ CurrentVersion\ Explorer\ ComDlg32\ Version
    HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\ CurrentVersion\ Explorer\ ComDlg32
    HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\ CurrentVersion\ Explorer\ ComDlg32\ Version
    Mydoom.A creates these entries in order to check if it has already affected the computer.

Means of transmission 

Mydoom.A spreads via e-mail and through the peer-to-peer (P2P) file sharing program KaZaA.

1.- Transmission via e-mail.

Mydoom.A follows the routine below:

  • It reaches the computer in an e-mail message with variable characteristics:

    Sender:
    Mydoom.A spoofs the e-mail address from which it is sent. This may cause confusion. For further information, click here.

    Subject: it can be one of the following:
    test
    hi
    hello
    Mail Delivery System
    Mail Transaction Failed
    Server Report
    Status
    Error


    Message: one of the following:
    Mail Transaction Failed. Partial message is available.
    The message contains Unicode characters and has been sent as a binary attachment.
    The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.


    Attachments: the file name is variable, and has a random extension:
    Possible file names: DOCUMENT, README, DOC, TEXT, FILE, DATA, TEST, MESSAGE, BODY.
    Possible extensions: PIF, SCR, EXE, CMD, BAT, ZIP.
    Sometimes, the attachment has a double extension. In this case, the first extension is always one of the following: HTM, TXT or DOC.
  • The computer is affected when the attached file is run.
  • Mydoom.A searches for e-mail addresses in files that have the following extensions: HTM, SHT, PHP, ASP, DBX, TBB, ADB, PL, WAB and TXT.
  • Mydoom.A sends itself out to all the addresses it has gathered and to all the contacts in the Windows Address Book, using its own SMTP engine.
    In order to do so, it attempts to open an SMTP session and connect to possible mail servers, which it compounds by adding the following prefixes to the mail domain of the recipient: gate., mail., mail1., mx., mx1., mxs., ns., relay., smtp..
  • However, it does not send itself to the addresses that have the following characteristics:

    - The mail domain contains one of the following text strings: .gov, .mil, acketst, arin., avp, berkeley, borlan, bsd, example, fido, foo., fsf., gnu, google, gov., hotmail, iana, ibm.com, icrosof, ietf, inpris, isc.o, isi.e, kernel, linux, math, mit.e, mozilla, msn., mydomai, nodomai, panda, pgp, rfc-ed, ripe., ruslis, secur, sendmail, sopho, syma, tanford.e, unix, usenet, utgers.ed.
    - The name of the recipient is one of the following: anyone, bugs, ca, contact, feste, gold-certs, help, info, me, no, nobody, noone, not, nothing, page, postmaster, privacy, rating, root, samples, service, site, soft, somebody, someone, submit, the.bat, webmaster, you, your.
    - The mail account constains any of the following text strings: admin, icrosoft, support, ntivi, unix, bsd, linux, listserv, certific, google, accoun.

 

2.- Transmission through KaZaA.

Mydoom.A follows the routine below:

  • It creates copies of itself in the shared directory of KaZaA. These copies have a variable name, which consists of a random file name and a random extension:
    Possible file names: WINAMP5, ICQ2004-FINAL, ACTIVATION_CRACK, STRIP-GIRL-2.0BDCOM_PATCHES, ROOTKITXP, OFFICE_CRACK, NUKE2004.
    Possible extensions: PIF, SCR, BAT, EXE.
  • Other users of KaZaA can access the shared directory and download these files to their computers, thinking that they are useful computer programs. However, these users will actually download a copy of the worm.
  • When the downloaded file is run, these computers will be affected by Mydoom.A.

Further Details  

Mydoom.A is written in the Assembler language. The worm is 22,528 bytes in size when it is compressed with UPX, and 32,768 bytes once it is decompressed.

Mydoom.A creates a mutex called SwebSipcSmtxSO in order to ensure that only a copy of the worm is run simultaneously.

Some of the text strings used by the worm are encrypted using a shift functionality that consists in shifting the characters 13 positions to the right.

Note: on February 10, 2004, a new variant of this worm was detected by PandaLabs. This variant carries out the same actions as the original, but it is compressed with Petite rather than with UPX. It is 24,048 bytes in size when it is compressed, and 42,280 bytes once it is decompressed.

ARE YOU FACING ANY PC OR INTERNET RELATED PROBLEMS?
FREE SUPPORT INCLUDED. CALL US 24/7

powered by Anytech365