ESecurityGuy
USER: Visitor
PRINT PAGE
Home > Free Security Articles > Resource Articles > Detecting and Removing Mydoom November 18, 2017


Free Newsletter
Free Security Articles
Free Security Software
Free Security Tools

Security News

Feedback Form

Site Map


Username

Password

Click here to register.

Detecting and Removing Mydoom / Novarg

This worm has been called "the worst e-mail worm incident in virus history," by F-Secure, a Finish network security company. It has been estimated by Message Labs that 1 in 12 e-mail messages carried on the Internet is generated by the worm. "This is the most aggressive [worm] that we have seen to date," said Mark Sunner, chief technology officer for MessageLabs.

How to Detect the Worm

Mydoom manipulates any infected computers very effectively. It opens back doors, hides and installs itself into Kazaa directories and places itself into your system's registry so that it will automatically re-install itself into memory if your system is rebooted.

Things to check:

  • The first time you run the worm, it will open notepad.exe and display garbled data (binary). Any time a program, such as notepad, is run without you having specifically invoked it, you should be concerned.
  • The worm will attempt to create the following files in the Windows System directory: explorer.exe and ctfmon.dll. Use Windows Explorer to open your Windows System directory, and check to see if there is a recently modified explorer.exe or ctfmon.dll file.
  • Run regedit, and check the key "HKLM\Software\Microsoft\Windows\CurrentVersion\Run". If it contains Explorer=C:\WINDOWS\system32\explorer.exe, then the machine has been infected.
  • If Kazaa is installed on the machine, check in the Kazaa shared directory for any of the following files:
    • attackXP-1.26
    • BlackIce_Firewall_Enterpriseactivation_crack
    • MS04-01_hotfix
    • NessusScan_pro
    • icq2004-final
    • winamp5
    • xsharez_scanner
    • zapSetup_40_148
    The files will have one of the following extensions: .exe, .scr, .pif or .bat
  • Check %WINDIR%\system32\drivers\etc\hosts to see if the following entry is present: 0.0.0.0 ftp.f-secure.com securityresponse.symantec.com

If you've got one or more of the above symptoms, you're infected.

How to Clean Up After MyDoom

  • Edit %WINDIR%\system32\drivers\etc\hosts so that the only line contained in it is:
    127.0.0.1 localhost localhost.localdomain local lo
    Note that some businesses may have other legitimate entries in the hosts file, so be careful. As a rule any line starting with 0.0.0.0 should be removed.
  • Once the hosts file is cleaned up you should be able to connect to your anti-virus vendor's site to download updates to protect against the MyDoom worm. Do so & scan your entire computer for the worm & remove it.
  • Remove Kazaa if you haven't already done so. Remove everything in your shared Kazaa folder.
  • Remove all files and the Windows registry key modifications described in the Detection section above.

In the Meantime

Configure e-mail servers and workstations to block file types commonly used by malicious code to spread to other computers. Block ZIP and executable extensions on the gateway and groupware level. Also monitor traffic on the network and block ports associated with Mydoom, especially inbound TCP ports for the backdoor Trojan component and the outbound TCP 10080 port data. Administrators may also find value in monitoring traffic associated with the DDoS component. Carefully manage all new files, scanning them with updated anti-virus software using heuristics prior to use.

Additional Information

Also Known As

Mydoom.B Aliases: Mydoom.B Mydoom Novarg

Size

29184

Subject Lines

"test," "hi," "hello," "Mail Delivery System," "Mail Transaction Failed," "Server Report," "Status," or "Error."

Attachment Names

"document," "readme," "doc," "text," "file," "data," "test," "message," or "body".

Worm Name File Extensions

.exe, .cmd, .bat, .pif, .scr or .zip

See Also



Free Computer Security Newsletter
Your email address:

Your name:

Listen to Craig on ClearChannel radio every Saturday from 6 to 9am on WGIR, WGIP and WGIN. Visit WGIR

Copyright 2003- 2007 DGKL, Inc. PRINT PAGE