Defend what you create

Other Resources

Close

Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Win32.HLLM.MyDoom.based

(I-Worm/Mytob.XY, Net-Worm.Win32.Mytob.bi, WORM_MYTOB.OH, WORM_MYDOOM.GEN, Net-Worm.Win32.Mytob.t, WORM_MYTOB.DM, Worm/Mytos.C, Worm/Mytob.JS, W32/Mytob.gen@MM!6d03, WORM_MYTOB.DJ, Generic.Netsky.4E482AB6, W32/Mytob.ih@MM, Worm/Mytob.MI, TR/Crypt.NSPI.Gen, Worm/Mytob.AA, WORM_MYTOB.FP, Worm/Mytob.ja, WORM_MYTOB.RC, Worm/Mytob.II, WORM_MYTOB.DB, I-Worm/Mytob.AAK, W32/Mytob.ao@MM, I-Worm/Mytob.CA, I-Worm/Mytob.AH, W32/Generic.x, I-Worm/Mytob.AAY, Generic.Mydoom.EB3A915A)

Added to the Dr.Web virus database: 2004-01-28

Virus description added:

Virus Type: Mass mailing worms

Affected OS: Win95/98/Me/2000/XP

Size: can be 29 149 byte, 24 576 byte, 40 480 byte, 44 544 byte, 50 688 byte, 34 568 byte, 37 888 byte, 88 640 byte

Packed by: can be packed by UPX, FSG

Technical Information

  • Scans local disks for email addresses which are in search for further spreading. At the same time it looks through files with following extensions:

    .adb
    .asp
    .dbx
    .htm
    .php
    .sht
    .tbb
    .txt
    .wab

  • For providing its further running registers itself in system registry:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

  • Registers its own proxy-server in
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad

  • Puts its copies into system catalogue - C:\%WinDir%\System32 with such filenames:

    SVRHOST.EXE
    taskgmgr.exe

  • Unloads from memory and blocks starting of the following processes which belong to different security systems, system services, and also to some malicious codes:

    ZONEALARM
    ZONALM2601
    ZATUTOR
    ZAPSETUP3001
    ZAPRO
    XPF202EN
    WYVERNWORKSFIREWALL
    WUPDT
    WUPDATER
    WSBGATE
    WRCTRL
    WRADMIN
    WNT
    WNAD
    WKUFIND
    WINUPDATE
    WINTSK32
    WINSTART001
    WINSTART
    WINSSK32
    WINSERVN
    WINRECON
    WINPPR32
    WINNET
    WINMAIN
    WINLOGIN
    WININITX
    WININIT
    WININETD
    WINDOWS
    WINDOW
    WIN-BUGSFIX
    WINACTIVE
    WIN32US
    WIN32
    WIMMUN32
    WHOSWATCHINGME
    WGFE95
    WFINDV32
    WEBTRAP
    WEBSCANX
    WEBDAV
    WATCHDOG
    W9X
    W32DSM89
    VSWINPERSE
    VSWINNTSE
    VSWIN9XE
    VSSTAT
    VSMON
    VSMAIN
    VSISETUP
    VSHWIN32
    VSECOMR
    VSCHED
    VSCENU6.02D30
    VSCAN40
    VPTRAY
    VPFW30S
    VPC42
    VPC32
    VNPC3000
    VNLAN300
    VIRUSMDPERSONALFIREWALL
    VIR-HELP
    VFSETUP
    VETTRAY
    VET95
    VET32
    VCSETUP
    VBWINNTW
    VBWIN9X
    VBUST
    VBCONS
    VBCMSERV
    UTPOST
    UPGRAD
    UPDATE
    UPDAT
    UNDOBOOT
    TVTMD
    TVMD
    TSADBOT
    TROJANTRAP3
    TRJSETUP
    TRJSCAN
    TRICKLER
    TRACERT
    TITANINXP
    TITANIN
    TGBOB
    TFAK5
    TFAK
    TEEKIDS
    TDS-3
    TDS2-NT
    TDS2-98
    TCM
    TCA
    TC
    TBSCAN
    TAUMON
    TASKMON
    TASKMO
    TASKMG
    SYSUPD
    SYSTEM32
    SYSTEM
    SYSEDIT
    SYMTRAY
    SYMPROXYSVC
    SWEEPNET.SWEEPSRV.SYS.SWNETSUP
    SWEEP95
    SVSHOST
    SVCHOSTS
    SVCHOSTC
    SVC
    SUPPORTER5
    SUPPORT
    SUPFTRL
    STCLOADER
    START
    ST2
    SSGRATE
    SSG_4104
    SS3EDIT
    SRNG
    SREXE
    SPYXX
    SPOOLSV32
    SPOOLCV
    SPOLER
    SPHINX
    SPF
    SPERM
    SOFI
    SOAP
    SMSS32
    SMS
    SMC
    SHOWBEHIND
    SHN
    SHELLSPYINSTALL
    SH
    SGSSFW32
    SFC
    SETUPVAMEEVAL
    SETUP_FLOWPROTECTOR_US
    SERVLCES
    SERVLCE
    SERVICE
    SERV95
    SD
    SCVHOST
    SCRSVR
    SCRSCAN
    SCANPM
    SCAN95
    SCAN32
    SCAM32
    SC
    SBSERV
    SAVENOW
    SAVE
    SAHAGENT
    SAFEWEB
    RUXDLL32
    RUNDLL16
    RUNDLL
    RUN32DLL
    RULAUNCH
    RTVSCN95
    RTVSCAN
    RSHELL
    RRGUARD
    RESCUE32
    RESCUE
    REGEDT32
    REGEDIT
    REGED
    REALMON
    RCSYNC
    RB32
    RAY
    RAV8WIN32ENG
    RAV7WIN
    RAV7
    RAPAPP
    QSERVER
    QCONSOLE
    PVIEW95
    PUSSY
    PURGE
    PSPF
    PROTECTX
    PROPORT
    PROGRAMAUDITOR
    PROCEXPLORERV1.0
    PROCESSMONITOR
    PROCDUMP
    PRMVR
    PRMT
    PRIZESURFER
    PPVSTOP
    PPTBC
    PPINUPDT
    POWERSCAN
    PORTMONITOR
    PORTDETECTIVE
    POPSCAN
    POPROXY
    POP3TRAP
    PLATIN
    PINGSCAN
    PGMONITR
    PFWADMIN
    PF2
    PERSWF
    PERSFW
    PERISCOPE PENIS
    PDSETUP
    PCSCAN
    PCIP10117_0
    PCFWALLICON
    PCDSETUP
    PCCWIN98
    PCCWIN97
    PCCNTMON
    PCCIOMON
    PCC2K_76_1436
    PCC2002S902
    PAVW
    PAVSCHED
    PAVPROXY
    PAVCL
    PATCH
    PANIXK
    PADMIN
    OUTPOSTPROINSTALL
    OUTPOSTINSTALL
    OUTPOST
    OTFIX
    OSTRONET
    OPTIMIZE
    ONSRVR
    OLLYDBG
    NWTOOL16
    NWSERVICE
    NWINST4
    NVSVC32
    NVC95
    NVARCH16
    NUPGRADE
    NUI
    NTXconfig
    NTVDM
    NTRTSCAN
    NT
    NSUPDATE
    NSTASK32
    NSSYS32
    NSCHED32
    NPSSVC
    NPSCHECK
    NPROTECT
    NPFMESSENGER
    NPF40_TW_98_NT_ME_2K
    NOTSTART
    NORTON_INTERNET_SECU_3.0_407
    NORMIST
    NOD32
    NMAIN
    NISUM
    NISSERV
    NETUTILS
    NETSTAT
    NETSPYHUNTER-1.2
    NETSCANPRO
    NETMON
    NETINFO
    NETD32
    NETARMOR
    NEOWATCHLOG
    NEOMONITOR
    NDD32
    NCINST4
    NC2000
    NAVWNT
    NAVW32
    NAVSTUB
    NAVNT
    NAVLU32
    NAVENGNAVEX15.NAVLU32
    NAVDX
    NAVAPW32
    NAVAPSVC
    NAVAP.NAVAPSVC
    NAV
    N32SCANW
    MWATCH
    MU0311AD
    MSVXD
    MSSYS
    MSSMMC32
    MSMSGRI32
    MSMGT
    MSLAUGH
    MSINFO32
    MSIEXEC16
    MSDOS
    MSDM
    MSCONFIG
    MSCMAN
    MSCCN32
    MSCACHE
    MSBLAST
    MSBB
    MSAPP
    MRFLUX
    MPFTRAY
    MPFSERVICE
    MPFAGENT
    MOSTAT
    MOOLIVE
    MONITOR
    MMOD
    MINILOG
    MGUI
    MGHTML
    MGAVRTE
    MGAVRTCL
    MFWENG3.02D30
    MFW2EN
    MFIN32
    MD
    MCVSSHLD
    MCVSRTE
    MCUPDATE
    MCTOOL
    MCSHIELD
    MCMNHDLR
    MCAGENT
    MAPISVC32
    LUSPT
    LUINIT
    LUCOMSERVER
    LUAU
    LUALL
    LSETUP
    LORDPE
    LOOKOUT
    LOCKDOWN2000
    LOCKDOWN
    LOCALNET
    LOADER
    LNETINFO
    LDSCAN
    LDPROMENU
    LDPRO
    LDNETMON
    LAUNCHER
    KILLPROCESSSETUP161
    KERNEL32
    KERIO-WRP-421-EN-WIN
    KERIO-WRL-421-EN-WIN
    KERIO-PF-213-EN-WIN
    KEENVALUE
    KAZZA
    KAVPF
    KAVPERS40ENG
    KAVLITE40ENG
    JEDI
    JDBGMRG
    JAMMER
    ISTSVC
    ISRV95
    ISASS
    IRIS
    IPARMOR
    IOMON98
    INTREN
    INTDEL
    INIT
    INFWIN
    INFUS
    INETLNFO
    IFW2000
    IFACE
    IEXPLORER
    IEDRIVER
    IEDLL
    IDLE
    ICSUPPNT
    ICSUPP95
    ICMON
    ICLOADNT
    ICLOAD95
    IBMAVSP
    IBMASN
    IAMSTATS
    IAMSERV
    IAMAPP
    HXIUL
    HXDL
    HWPE
    HTPATCH
    HTLOG
    HOTPATCH
    HOTACTIO
    HIJACKTHIS
    HBSRV
    HBINST
    HACKTRACERSETUP
    GUARDDOG
    GUARD
    GMT
    GENERICS
    GBPOLL
    GBMENU
    GATOR
    F-STOPW
    FSMB32
    FSMA32
    FSM32
    FSGK32
    FSAV95
    FSAV530WTBYB
    FSAV530STBYB
    FSAV32
    FSAV
    FSAA
    FRW FP-WIN_TRIAL
    FP-WIN
    F-PROT95
    F-PROT
    FPROT
    FNRB32
    FLOWPROTECTOR
    FIREWALL
    FINDVIRU
    FIH32
    FCH32
    FAST
    FAMEH32
    F-AGOBOT
    F-AGNT95
    EXPLORE
    EXPERT
    EXE.AVXW
    EXANTIVIRUS-CNET
    EVPN
    ETRUSTCIPE
    ETHEREAL
    ESPWATCH
    ESCANV95
    ESCANHNT
    ESCANH95
    ESAFE
    ENT
    EMSW
    EFPEADM
    ECENGINE
    DVP95_0
    DVP95
    DSSAGENT
    DRWEBUPW
    DRWEB32
    DRWATSON
    DPPS2
    DPFSETUP
    DPF
    DOORS
    DLLREG
    DLLCACHE
    DIVX
    DEPUTY
    DEFWATCH
    DEFSCANGUI
    DEFALERT
    DCOMX
    DATEMANAGER
    CWNTDWMO
    CWNB181
    CV
    CTRL
    CPFNT206
    CPF9X206
    CPD
    CONNECTIONMONITOR
    CMON016
    CMGRDIAN
    CMESYS
    CMD32
    CLICK
    CLEANPC
    CLEANER3
    CLEANER
    CLEAN
    CLAW95CF
    Claw95
    CFINET32
    CFINET
    CFIAUDIT
    CFIADMIN
    CFGWIZ
    CFD
    CDP
    CCSETMGR
    CCPXYSVC
    CCEVTMGR
    CCAPP
    BVT
    BUNDLE
    BS120
    BRASIL
    BPC
    BORG2
    BOOTWARN
    BOOTCONF
    BLSS
    BLACKICE
    BLACKD
    BISP
    BIPCPEVALSETUP
    BIPCP
    BIDSERVER
    BIDEF
    BELT
    BEAGLE
    BD_PROFESSIONAL
    BARGAINS
    BACKWEB
    AVXQUAR
    AVXMONITORNT
    AVXMONITOR9X
    AVWUPSRV
    AVWUPD32
    AVWUPD
    AVWINNT
    AVWIN95
    AVSYNMGR
    AVSCHED32
    AVPUPD
    AVPTC32
    AVPM
    AVPDOS32
    AVPCC
    AVP32
    AVP
    AVNT
    AVLTMAIN
    AVKWCTl9
    AVKSERVICE
    AVKSERV
    AVKPOP
    AVGW
    AVGUARD
    AVGSERV9
    AVGSERV
    AVGNT
    AVGCTRL
    AVGCC32
    AVE32
    AVCONSOL
    AUTOUPDATE
    AUTOTRACE
    AUTO-PROTECT.NAV80TRY
    AUTODOWN
    AUPDATE
    AU
    ATWATCH
    ATRO55EN
    ATGUARD
    ATCON
    ARR
    APVXDWIN
    APLICA32
    APIMONITOR
    ANTS
    ANTIVIRUS
    ANTI-TROJAN
    AMON9X
    ALOGSERV
    ALEVIR
    ALERTSVC
    AGENTW
    AGENTSVR
    ADVXDWIN
    ADAWARE
    ACKWIN32
    _AVPM
    _AVPCC
    _AVP32
    DRVDDLL
  • Uses its own STMP-protocol realization for distribution of infected letters. Falsifies user’s address. Field From is formed in the following way – user’s name (username@) is chosen from such list:

    vladimir
    otto
    penny
    marie
    freddy
    elvin
    anthony
    zidane
    connie
    lenny
    vivian
    walter
    stephen
    brovac
    hanson
    carey
    joshua
    linda
    julie
    jimmy
    jerry
    helen
    lissy
    claudia
    humm
    anna
    alice
    stella
    adam
    harry
    fred
    jack
    bill
    stan
    smith
    steve
    matt
    dave
    ronnie
    joe
    jane
    bob
    robert
    peter
    tom
    chang
    mary
    william
    brian
    jim
    maria
    dolly
    jose
    steven
    sam
    george
    david
    kevin
    mike
    james
    michael
    alex
    john
    niky
  • Substitutes one of domainnames (@domainname):
    mail.china.com
    hanmail.net
    k.ro
    dcemail.com
    brain.com.pk
    arabia.com
    mail.ee
    student.be
    mail.com.fr
    email.it
    mail.gr
    online.ie
    freemail.nl
    email.ro
    hotpop.com
    yook.de
    lovemail.com
    usa.com
    21cn.com
    163.com
    yahoo.co.uk
    lycos.com
    mailcity.com
    sina.com
    hotmail.com
    yahoo.com
    msn.com
    aol.com
    juno.com
    fbi.gov
    cia.gov
  • Doesn’t spread if addresses contain the following substrings:

    abuse
    accoun
    acketst
    admin
    anyone
    arin.
    avp
    bugs
    ca
    certific
    contact
    example
    feste
    fido
    foo.
    fsf.
    gnu
    gold-certs
    google
    help
    info
    linux
    listserv
    me
    no
    nobody
    noone
    not
    nothing
    ntivi
    page
    postmaster
    privacy
    rating
    root
    samples
    service
    site
    soft
    somebody
    someone
    submit
    support
    the.bat
    unix
    webmaster
    you
    your
  • and also if domain name contains such substrings:

    .edu
    .gov
    .mil
    arin.
    berkeley
    borlan
    bsd
    example
    fido
    foo.
    fsf.
    gnu
    google
    gov.
    iana
    ibm.com
    icrosof
    icrosoft
    ietf
    inpris
    isc.o
    isi.e
    kernel
    linux
    math
    mit.e
    mozilla
    mydomai
    nodomai
    panda
    pgp
    rfc-ed
    ripe.
    ruslis
    secur
    sendmail
    sopho
    symav
    tanford.e
    unix
    usenet
    utgers.ed
    www

  • Search for operating SMTP-servers in user’s domain for its further spreading. Use prefixes:

    mx.
    mail.
    smtp.
    mx1.
    mxs.
    mail1.
    relay.
    ns.
    gate.

  • Here are some examples of what can be written in distributed letters:

    ----------
    If you want to see this video please open this URL with your favorite media player such as WinAmp or Windows Media Player. [сслыка на видео] If there is fail please download it from your email attachment.

    Don't get wrong anymore!Hope the files is right!

    Sorry, I'm late yesterday. But please read the file first!

    I really need your help!

    Here it is my response. Please reply back if got an idea.

    Hope this is not a wrong file as you told me.

    The previous file i have sended to you before are not correct. So, this is the correct file.

    Have you read the file in the attachment?

    If you found this email with an attachment please refer to the email attachment in order to read the sender email.

    You have received this email with an email attachment. Please refer to your email attachment if you want to read the message.

    Because of our services are not configured properly. We have converted your message as an attachment. Please download the file to read. Please note that your message has been converted to an attachment. Please refer to the attachment in order to read the file.
    ----------

  • Can sign its copies on behalf of various antivirus vendors. Examples:

    +++ Attachment: No Virus found
    +++ Attachment: No Virus found
    +++ Attachment: No Infection found
    +++ Attachment: No Infection found
    Norton AntiVirus - www.symantec.com
    Norton AntiVirus - www.symantec.com
    F-Secure AntiVirus - www.f-secure.com
    F-Secure AntiVirus - www.f-secure.com
    Norman AntiVirus - www.norman.com
    Norman AntiVirus - www.norman.com
    Panda AntiVirus - www.pandasoftware.com
    Panda AntiVirus - www.pandasoftware.com
    Kaspersky AntiVirus - www.kaspersky.com
    Kaspersky AntiVirus - www.kaspersky.com
    MC-Afee AntiVirus - www.mcafee.com
    MC-Afee AntiVirus - www.mcafee.com
    Bitdefender AntiVirus - www.bitdefender.com
    Bitdefender AntiVirus - www.bitdefender.com
    MessageLabs AntiVirus - www.messagelabs.com
    MessageLabs AntiVirus - www.messagelabs.com

  • Attachments in spreaded emails can be with such extensions:

    .pif
    .scr
    .exe
    .cmd
    .bat

  • Various modifications of representatives of email worm family Win32.HLLM.MyDoom.based can contain modules of keylogger (log32zx.exe), proxy-server (shimgapi.dll) for spam spreading and also loaders of some malicious programs.
  • The Russian developer of Dr.Web anti-viruses
    Doctor Web has been developing anti-virus software since 1992
    Dr.Web is trusted by users around the world in 200+ countries
    The company has delivered an anti-virus as a service since 2007
    24/7 tech support

    Dr.Web © Doctor Web
    2003 — 2020

    Doctor Web is the Russian developer of Dr.Web anti-virus software. Dr.Web anti-virus software has been developed since 1992.

    2-12А, 3rd street Yamskogo polya, Moscow, Russia, 125040