Virus Encyclopedia

Welcome to the Virus Encyclopedia of Panda Security.

Mydoom.A
Threat Level Damage Distribution

Infection strategy 

Mydoom.A creates the following files in the Windows system directory:

• TASKMON.EXE. This file is a copy of the worm.
• SHIMGAPI.DLL. This file creates a backdoor, opening the first available TCP port in the range from 3127 to 3198.
• MESSAGE in the Windows temporary directory. This file contains the text shown in Notepad the first time the worm activates.

Mydoom.A creates the following entries in the Windows Registry:

• HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\ CurrentVersion\ Run
  TaskMon = %sysdir%\taskmon.exe
  where %sysdir% is the Windows system directory. By default, in Windows Me/98/95 computers, this directory is C:\ WINDOWS\ SYSTEM, whereas in Windows 2003/XP/2000/NT computers, it is C:\ WINNT\ SYSTEM32.
  By creating this entry, Mydoom.A ensures that it is run whenever Windows is started.
  If it is unable to create this entry, it creates the following one:
  
  HKEY_CURRENT_USER\ Software\ Microsoft\ Windows\ CurrentVersion\ Run
  TaskMon = %sysdir%\ taskmon.exe
• HKEY_CLASSES_ROOT\ CLSID\ {E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ InProcServer
  (default) = %sysdir%\ SHIMGAPI.DLL
  By creating this entry, Mydoom.A launches the file SHIMGAPI.DLL with Windows Explorer.
• HKEY_CURRENT_USER\ Software\ Microsoft\ Windows\ CurrentVersion\ Explorer\ ComDlg32
  HKEY_CURRENT_USER\ Software\ Microsoft\ Windows\ CurrentVersion\ Explorer\ ComDlg32\ Version
  HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\ CurrentVersion\ Explorer\ ComDlg32
  HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\ CurrentVersion\ Explorer\ ComDlg32\ Version
  Mydoom.A creates these entries in order to check if it has already affected the computer.

Means of transmission 

Mydoom.A spreads via e-mail and through the peer-to-peer (P2P) file sharing program KaZaA.

1.- Transmission via e-mail.

Mydoom.A follows the routine below:

• It reaches the computer in an e-mail message with variable characteristics:
  
  Sender:
  Mydoom.A spoofs the e-mail address from which it is sent. This may cause confusion. For further information, click here.
  
  Subject: it can be one of the following:
  test
  hi
  hello
  Mail Delivery System
  Mail Transaction Failed
  Server Report
  Status
  Error
  
  Message: one of the following:
  Mail Transaction Failed. Partial message is available.
  The message contains Unicode characters and has been sent as a binary attachment.
  The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.
  
  Attachments: the file name is variable, and has a random extension:
  Possible file names: DOCUMENT, README, DOC, TEXT, FILE, DATA, TEST, MESSAGE, BODY.
  Possible extensions: PIF, SCR, EXE, CMD, BAT, ZIP.
  Sometimes, the attachment has a double extension. In this case, the first extension is always one of the following: HTM, TXT or DOC.
• The computer is affected when the attached file is run.
• Mydoom.A searches for e-mail addresses in files that have the following extensions: HTM, SHT, PHP, ASP, DBX, TBB, ADB, PL, WAB and TXT.
• Mydoom.A sends itself out to all the addresses it has gathered and to all the contacts in the Windows Address Book, using its own SMTP engine.
  In order to do so, it attempts to open an SMTP session and connect to possible mail servers, which it compounds by adding the following prefixes to the mail domain of the recipient: gate., mail., mail1., mx., mx1., mxs., ns., relay., smtp..
• However, it does not send itself to the addresses that have the following characteristics:
  
  - The mail domain contains one of the following text strings: .gov, .mil, acketst, arin., avp, berkeley, borlan, bsd, example, fido, foo., fsf., gnu, google, gov., hotmail, iana, ibm.com, icrosof, ietf, inpris, isc.o, isi.e, kernel, linux, math, mit.e, mozilla, msn., mydomai, nodomai, panda, pgp, rfc-ed, ripe., ruslis, secur, sendmail, sopho, syma, tanford.e, unix, usenet, utgers.ed.
  - The name of the recipient is one of the following: anyone, bugs, ca, contact, feste, gold-certs, help, info, me, no, nobody, noone, not, nothing, page, postmaster, privacy, rating, root, samples, service, site, soft, somebody, someone, submit, the.bat, webmaster, you, your.
  - The mail account constains any of the following text strings: admin, icrosoft, support, ntivi, unix, bsd, linux, listserv, certific, google, accoun.

2.- Transmission through KaZaA.

Mydoom.A follows the routine below:

• It creates copies of itself in the shared directory of KaZaA. These copies have a variable name, which consists of a random file name and a random extension:
  Possible file names: WINAMP5, ICQ2004-FINAL, ACTIVATION_CRACK, STRIP-GIRL-2.0BDCOM_PATCHES, ROOTKITXP, OFFICE_CRACK, NUKE2004.
  Possible extensions: PIF, SCR, BAT, EXE.
• Other users of KaZaA can access the shared directory and download these files to their computers, thinking that they are useful computer programs. However, these users will actually download a copy of the worm.
• When the downloaded file is run, these computers will be affected by Mydoom.A.

Further Details  

Mydoom.A is written in the Assembler language. The worm is 22,528 bytes in size when it is compressed with UPX, and 32,768 bytes once it is decompressed.

Mydoom.A creates a mutex called SwebSipcSmtxSO in order to ensure that only a copy of the worm is run simultaneously.

Some of the text strings used by the worm are encrypted using a shift functionality that consists in shifting the characters 13 positions to the right.

Note: on February 10, 2004, a new variant of this worm was detected by PandaLabs. This variant carries out the same actions as the original, but it is compressed with Petite rather than with UPX. It is 24,048 bytes in size when it is compressed, and 42,280 bytes once it is decompressed.