Email-Worm.Win32.Mydoom.ae
Jest to robak rozprzestrzeniaj膮cy si臋 przez Internet jako za艂膮cznik zainfekowanych wiadomo艣ci e-mail oraz za po艣rednictwem sieci wymiany plik贸w (P2P). Ma posta膰 pliku PE EXE o rozmiarze oko艂o 32 KB (kompresja UPX, rozmiar po rozpakowaniu - oko艂o 83 KB).
W32/Mydoom.gen@MM (McAfee), W32.Mydoom.AI@mm (Symantec), Win32.HLLM.MyDoom.8 (Doctor Web), W32/MyDoom-AA (Sophos), Win32/Mydoom.AC@mm (RAV), WORM_MYDOOM.AF (Trend Micro), Worm/Mydoom.af (H+BEDV), W32/Mydoom.AM@mm (FRISK), I-Worm/Mydoom.AE (Grisoft), Win32.Mydoom.AE@mm (SOFTWIN), Worm.Mydoom.Gen-unp (ClamAV), W32/Mydoom.AE.worm (Panda), Win32/Swash.B (Eset)
Po uruchomieniu robak otwiera Notatnik wchodz膮cy w sk艂ad systemu Windows (notepad.exe) i wy艣wietla w nim losowe znaki. Nast臋pnie szkodnik kopiuje si臋 do foldera WindowsSystem z nazw膮 lasasrv.exe i tworzy dla tej kopii klucz auto-run w rejestrze systemowym, co zapewnia mu uruchamianie wraz z ka偶dym startem systemu operacyjnego:
[HKLMSoftwareMicrosoftWindows NTCurrentVersionWinlogon]
"Shell" = "explorer.exe %System%lsasrv.exe"
Dodatkowo szkodnik tworzy w folderze WindowsSystem pliki:
version.ini hserv.sys
Adresy potencjalnych ofiar pobierane s膮 z systemowej ksi膮偶ki adresowej Windows oraz z plik贸w posiadaj膮cych nast臋puj膮ce rozszerzenia:
adb asa asc asm asp cgi con csp dbx dlt dwt edm hta htc htm inc jsp jst lbi php pl rdf rss sht ssi stm tbb tpl txt vbp vbs wab wml xht xml xsd xst
Szkodnik nie wysy艂a w艂asnych kopii pod adresy zawieraj膮ce nast臋puj膮ce teksty:
.edu .gov .mil abuse accoun acketst admin anyone arin. avp berkeley borlan bsd bugs certific contact example feste fido foo. fsf. gnu gold-certs google gov. help iana ibm.com icrosof icrosoft ietf info inpris isc.o isi.e kernel linux listserv math mit.e mozilla mydomai nobody nodomai noone not nothing ntivi page panda pgp postmaster privacy rating rfc-ed ripe. root ruslis samples secure sendmail service site soft somebody someone sopho spm submit support syma tanford.e the.bat unix usenet utgers.ed webmaster www you your
W celu wysy艂ania wiadomo艣ci robak nawi膮zuje bezpo艣rednie po艂膮czenie z serwerem SMTP.
- Imi臋 nadawcy (wybierane z poni偶szych mo偶liwo艣ci):
adam alex alice andrew anna bill bob brenda brent brian claudia dan dave david debby fred george helen jack james jane jerry jim jimmy joe john jose julie kevin leo linda maria mary matt michael mike peter ray robert sam sandra serg smith stan steve ted tom
- Nazwisko nadawcy (wybierane z poni偶szych mo偶liwo艣ci):
Abdulrazak Ackerman Adams Addison Adelstein Adibe Adorno Ahlers Alavi Alcorn Alda Aleks Allison Alongi Altavilla Altenberger Altenhofen Amaral Amatangelo Ameer Amsden Anand Andel Ando Andrelus Andron Anfinrud Ansley Anthony Antos Arbia Arduini Arellano Aristotle Arjas Arky Atkins Augustus Aurelius Axelrod Axworthy Ayiemba Aykroyd Ayling Azima Bachmuth Backus Bady Baglivo Bagnold Bailar Bakanowsky Baleja Ballatori Ballew Baltz Banta Barabesi Barajas Baranczak Baranowska Barberi Barbetti Barneson Barnett Barriola Barry Bartholomew Bartolome Bartoo Basavappa Bashevis Batchelder Baumiller Bayles Bayo Beacon Beal Bean Beckman Beder Bedford Behenna Belanger Belaoussof Belfer Belin-Collart Bellavance Bellhouse Bellini Belloc Benedict-Dye Bergson Berke-Jenkins Bernardo Bernassola Bernston Berrizbeitia Betti Beynart Biagioli Bickel Binion Bir Bisema Bisho Blackbourn Blackwell Blagg Blakemore Blanke Bliss Blizard Bloch Bloembergen Bloemhof Bloxham Blyth Bolger Bolick Bollinger Bologna Boner Bonham Boniface Bontempo Book Bookbinder Boone Boorstin Borack Borden Bossi Bothman Botosh Boudin Boudrot Bourneuf Bowers Boxer Boyajian Boyes Boyland Boym Boyne Bracalente Bradac Bradach Brecht Breed Brenan Brennan Brewer Bridgeman Bridges Brinton Britz Broca Brook Brzycki Buchan Budding Bullard Bunton Burden Burdzy Burke Burridge Busetta Byatt Byerly Byrd Cage Calnan Cammelli Cammilleri Canley Capanni Caperton Capocaccia Capodilupo Cappuccio Capursi Caratozzolo Carayannopoulos Carlin Carlos Carlyle Carmichael Caroti Carper Cartmill Cascio Case Caspar Castelda Cavanagh Cavell Ceniceros Cerioli Chapman Charles Cheang Cherry Chervinsky Chiassino Chien Childress Childs Chinipardaz Chinman Christenson Christian Christiano Christie Christopher Chu Chupasko Church Ciampaglia Cicero Cifarelli Claffey Clancy Clark Clement Clifton Clow Coblenz Coito Coldren Colella Collard Collis Compton Comstock Concino Condodina Connors Corey Cornish Cosmides Counter Coutaux Crawford Crocker Croshaw Croxen Croxton Cui Cunningham Currier Cutler Cvek Cyders D'Ambra D'arcangelo D'fini D'souza Daldalian Daly Danieli Dante Dapice Das Dasgupta daSilva Daskalu David Dawkins Debroff Dees Defeciani DeGennaro del'Enclos DeLaPena Delattre Deleon-Rendon Delger Dell'acqua Deming Dempster Demusz Denault Denham Denison deRousse Desombre Deutsch Dicks Diefenbach Difabio Difronzo Dilworth Dionysius Dirksen Dockery Doherty Donahue Donner Doonan Dore Dorf Dosi Doty Doug Dowsland Drinker Duffin Durrett Dussault Dwyer Eardley Ebeling Eckel Edley Edner Edward Eickenhorst Eliasson Elmendorf Elmerick Elvis Encinas Enyeart Eppling Erbach Erdman Erdos Erez Espinoza Estes Etter Euripides Everett Fabbris Fagan Faioes Falco-Acosta Falorsi Faris Farone Farren Fasso' Fates Feigenbaum Fejzo Feldman Fernald Fernandes Ferrante Ferriell Feuer Fido Field Fink Finkelstein Finnegan Fiorina Fisk Fitzmaurice Flier Flores Folks Forester Fortes Fortier Fossey Fossi Francisco Franklin-Kenea Franz Frazier-Davis Freid Freundlich Fried Friedland Frisken Frowiss Fryberger Frye Fujii-Abe Fuller Furth Fusaro Gabrielli Gaggiotti Galeotti Galwey Gambini Garfield Garman Garonna Geller Gemberling Georgi Gerrett Ghorai Gibbens Gibson Gilbert Gili Gill Gillispie Gist Gleason Glegg Glendon Goldfarb Goncalves Gonzalez Good Goodearl Goody Gozzi Gravell Greenberg Greenfeld Griffiths Grigoletto Grummell Gruner Gruppe Guenthart Gunn Guo Haar Hackman Hackshaw Haley Halkias Hallowell Halpert Hambarzumjan Hamer Hammerness Hand Hanssen Harding Hargraves Harlow Harrigan Hartman Hartmann Hartnett Harwell Haviaras Hawkes Hayes Haynes Hazlewood Heermans Heft Heiland Hellman Hellmiss Helprin Hemphill Henery Henrichs Hernandez Herrera Hester Heubert Heyeck Himmelfarb Hind Hirst Hitchcock Hoang Hock Hoffer Hoffman Hokanson Hokoda Holmes Holoien Holter Holway Holzman Hooker Hopkins Horsley Hoshida Hostage Hottle Howard Hoy Huey Huidekoper Hungerford Huntington Hupp Hurtubise Hutchings Hyde Iaquinta Ichikawa Igarashi Inamura Inniss Isaac Isaievych Isbill Isserman Iyer Jacenko Jackson Jagers Jagger Jagoe Jain Jamil Janjigian Jarnagin Jarrell Jay Jeffers Jellis Jenkins Jespersen Jewett Johannesson Johannsen Johns Jolly Jorgensen Jucks Juliano Julious Kabbash Kaboolian Kafadar Kalbfleisch Kaligian Kalil Kalinowski Kalman Kamel Kangis Karpouzes Kassower Kasten Kawachi Kee Keenan Keepper Keith Kelker Kelsey Kempton Kemsley Kendall Kerry Keul Khong Kimmel Kimmett Kimura Kindall Kinsley Kippenberger Kirscht Kittridge Kleckner Kleiman Kleinfelder Klemperer Kling Klinkenborg Klint Knuff Kobrick Koch Kohn Koivumaki Kommer Koniaris Konrad Kool Korzybski Kotter Kovaks Kraemer Krailo Krasney Kraus Kroemer Krysiak Kuenzli Kumar Kusman Kuwabara l'Enclos Labunka Lafler Laing Lallemant Landes Lankes Lantieri Lanzit Laserna Lashley Lawless Lecar Lecce Leclercq Leite Lenard Lesser Lessi Liakos Lidano Liem Light Lightfoot Lim Linares Linda Linder Line Linehan Linzee Lippmann Lipponen Little Litvak Livernash Livi Livolsi Lizardo Locatelli Longworth Loss Loveman Lowenstein Loza Lubin Lucas Luciano Luczkow Luecke Lunetta Luoma Lussier Lutcavage Luzader Maccormac Macdonald Maceachern Macintyre Mackenney MacMillan Macy Madigan Maggio Mahony Maier Maine-Hershey Maisano Malatesta Maller Malova Manalis Mandel Manganiello Mantovan March Marchbanks Marcus Margalit Margetts Marques Martinez Martochio Marton Marubini Mass Matalka Matarazzo Matsukata Mattson Mauzy Mazzali Mazziotta Mcbride Mccaffery Mccall Mcclearn Mcdowell Mcelroy McFadden Mcghee Mcgoldrick McIlroy Mcintosh Mckenna Mclane Mclaren Mcnealy Mcnulty Meccariello Memisoglu Menzies Merikoski Merlani Merminod Merseth Merz Metelka Metropolis Meurer Michelman Middle Mieher Mills Minh Mini Minichiello Mitropoulos Mittal Mocroft Modestino Moeller Mohr Moiamedi Monque Montilio MooreDeCh. Morani Moreton Morrison Morrow Mortimer Mosher Mosler Mostafavi Motooka Mudarri Muello Mugnai Mulkern Mulroy Mumford Mussachio Naddeo Napolitano Nardi Nardone Naviaux Nayduch Nelson Nenna Nesci Neuman Newfeld Newlin Nickerson Nickoloff Nisenson Nitabach Notman Nuzum O'hagan O'malley O'meara Ocougne Ogata Oldford Olsen Olson Olszewski Oman Opel Oray Orfield Orsi Ospina Ostrowski Ottaviani Otten Ouchida Ovid PaesDealmeida Paine Palayoor Palepu Pallara Palmitesta Panadero Panizzon Pantilla Paoletti Parmeggiani Parris Partridge Pascucci Patefield Patrick Pattullo Pavetti Pavlon Pawloski Paynter Peabody Pearlberg Pederson Peishel Penny Pereira Perko Perlak Perlman Perna Perone Perrimon Peters Petruzello Pettibone Pettit Pfister Pilbeam Pinot Plancon Plant Plasket Plous Pocobene Poincaire Pointer Poirier Polak Polanyi Politis Poma Poolman Powers Presper Preucel Prevost Pritchard Pritz Proietti Prothrow-Stith Puccia Pugh Pynchon Quaday Quetin Rabe Rabkin Radeke Rajagopalan Raney Rangan Rankin Rapple Rayport Redden-Tyler Reedquist Reinold Remak Renick Repetto Resnik Rhea Richmond Rielly Rindos Rineer Rish Rivera Robinson Rocha Roesler Rogers Ronen Row Royal Ruan Ruderman Ruescher Rush Ryu Sabatello Sadler Safire Sahu Sali Samson Sanchez-Ramirez Sanna Sapers Sarin Sartore Sase Satin Satta Satterthwaite Sawtell Sayied Scarponi Scepan Scharf Scharlemann Scheiner Schiano Schifini Schilling Schmitt Schossberger Schuman Schutte Schuyler Schwan Schwickrath Scovel Scudder Seaton Seeber Segal Sekler Selvage Sen Sennett Seterdahl Sexton Seyfert Shaikh Shakis Shankland Shanley Shar Shatrov Shavelson Shea Sheats Shepherd Sheppard Shepstone Shesko Shia Shibata Shimon Siesto Sigalot Sigini Signa Silverman Silvetti Sinsabaugh Sirilli Sites Skane Skerry Skoda Sloan Slowe Smilow Sniffen Snodgrass Socolow Solon Somers Sommariva Sorabella Sorg Sottak Soukup Soule Soultanian Spanier Sparrow Spaulding Speizer Spence Sperber Spicer Spiegelhalter Spiliotis Spinrad Stalvey Stam Stang Stassinopolus States Statlender Stefani Steiner Stephanian Stepniewska Stewart-Oaten Stiepock Stillwell StMartin Stock Stockton Stockwell Stolzenberg Stonich Storer Stott Strange Strauch Streiff Stringer Sullivan Sumner Suo Surdam Sweeting Sweetser Swindle Tagiuri Tai Talaugon Tambiah Tandler Tanowitz Tatar Taveras Tawn Tcherepnin Teague Temes Temmer Tenney Terracini Than Thavaneswaran Theodos Thibault Thisted Thomsen Throop Tierney Till Timmons Tofallis Tollestrup Tolls Tolman Tomford Toomer Topulos Torresi Torske Towler Toye Traebert Trenga Trewin Tringali Troiani Troy Truss Tsiatis Tsomides Tsukurov Tuck Tudge Tukan Turano Turek Tuttle Twells Tzamarias Ullman Untermeyer Upsdell Urban Urdang-Brown Usdan Uzuner Vacca Valberg Valencia vanAllen Vandenberg Vanheeckeren VanZwet Vasquez Velasquez Venne Verghese Viana Viano Viens Vignola Villarreal Vitali Viviani Voigt VonHoffman Vorhaus Votey Waite Wales Wallenberg Walter Warshafsky Wasowska Waugh Weighart Weingarten Weinhaus Weissbourd Weissman Welles Welsh Wengret Wescott Wetzel Whately Whilton White Whitla Whittaker Wiedersheim Wiener Wilder Wilhelm Wilk Wilkin Wilkinson Willstatter Wilson Wolk Woo Wooden Woods Woods-Powell Yacono Yamane Yankee Yarchuk Yates Ybarra Yedidia Yesson Yetiv Yoffe Yoo Youk-See Zachary Zahedi Zangwill Zegans Zerbini Zoldak Zucconi Zurn Zwiers Zytowski
- Domena nadawcy (wybierana z poni偶szych mo偶liwo艣ci):
aol.com compuserve.com earthlink.net hotmail.com juno.com msn.com yahoo.co.uk yahoo.com
- Temat (wybierany z poni偶szych mo偶liwo艣ci):
Attention!!! Do not reply to this email Error Good day hello Mail Delivery System Mail Transaction Failed Server Report Status
- Tre艣膰 (wybierana z poni偶szych mo偶liwo艣ci):
The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment. Mail transaction failed. Partial message is available. Here are your documents you are requested. Thank you for registering at WORLDXXXPASS.COM All your payment info, login and password you can find in the attachment file. It's a real good choise to go to WORLDXXXPASS.COM Attention! New self-spreading virus! Be careful, a new self-spreading virus called "RTSW.Smash" spreading very fast via e-mail and P2P networks. It's about two million people infected and it will be more. To avoid your infection by this virus and to stop it we provide you with full information how to protect yourself against it and also including free remover. Your can find it in the attachment. c 2004 Networks Associates Technology, Inc. All Rights Reserved New terms and conditions for credit card holders Here a new terms and conditions for credit card holders using a credit cards for making purchase in the Internet in the attachment. Please, read it carefully. If you are not agree with new terms and conditions do not use your credit card in the World Wide Web. Thank you, The World Bank Group c 2004 The World Bank Group, All Rights Reserved Attention! Your IP was logged by The Internet Fraud Complaint Center Your IP was logged by The Internet Fraud Complaint Center. There was a fraud attempt logged by The Internet Fraud Complaint Center from your IP. This is a serious crime, so all records was sent to the FBI. All information you can find in the attachment. Your IP was flagged and if there will be anover attemption you will be busted. This message is brought to you by the Federal Bureau of Investigation and the National White Collar Crime Center
- Nazwa za艂膮cznika (wybierana z poni偶szych mo偶liwo艣ci):
body data doc docs document file message readme rules
- Rozszerzenie za艂膮cznika (wybierane z poni偶szych mo偶liwo艣ci):
bat cmd exe scr pif zip
Robak kopiuje si臋 z poni偶szymi nazwami do folder贸w wsp贸艂dzielonych program贸w KaZaa, Morpheus, iMesh, Edonkey, LimeWire:
activation_crack Ad-awareref01R349 adultpasswds avpprokey dcom_patches icq2004-final K-LiteCodecPack2.34a NeroBROM6.3.1.27 porno winamp5 winxp_patch
Kopie te mog膮 posiada膰 nast臋puj膮ce rozszerzenia:
bat exe scr pif
Robak dopisuje poni偶sze teksty do pliku %System%driversetchosts.
127.0.0.1 avp.com 127.0.0.1 ca.com 127.0.0.1 customer.symantec.com 127.0.0.1 dispatch.mcafee.com 127.0.0.1 download.mcafee.com 127.0.0.1 f-secure.com 127.0.0.1 grisoft.com 127.0.0.1 kaspersky.com 127.0.0.1 kaspersky-labs.com 127.0.0.1 liveupdate.symantec.com 127.0.0.1 liveupdate.symantecliveupdate.com 127.0.0.1 mast.mcafee.com 127.0.0.1 mcafee.com 127.0.0.1 my-etrust.com 127.0.0.1 nai.com 127.0.0.1 networkassociates.com 127.0.0.1 rads.mcafee.com 127.0.0.1 secure.nai.com 127.0.0.1 securityresponse.symantec.com 127.0.0.1 sophos.com 127.0.0.1 symantec.com 127.0.0.1 trendmicro.com 127.0.0.1 update.symantec.com 127.0.0.1 updates.symantec.com 127.0.0.1 us.mcafee.com 127.0.0.1 viruslist.com 127.0.0.1 www.avp.com 127.0.0.1 www.ca.com 127.0.0.1 www.f-secure.com 127.0.0.1 www.grisoft.com 127.0.0.1 www.kaspersky.com 127.0.0.1 www.mcafee.com 127.0.0.1 www.my-etrust.com 127.0.0.1 www.nai.com 127.0.0.1 www.networkassociates.com 127.0.0.1 www.sophos.com 127.0.0.1 www.symantec.com 127.0.0.1 www.trendmicro.com 127.0.0.1 www.viruslist.com
W rezultacie u偶ytkownik zainfekowanego komputera nie b臋dzie m贸g艂 otwiera膰 powy偶szych stron WWW.
Mydoom.ae zamyka procesy, kt贸rych nazwy zawieraj膮 nast臋puj膮ce teksty:
bbeagle.exe d3dupdate.exe i11r54n4.exe irun4.exe MSBLAST.exe msblast.exe mscvb32.exe navapw32.exe navw32.exe netstat.exe outpost.exe PandaAVEngine.exe Penis32.exe rate.exe ssate.exe sysinfo.exe SysMonXP.exe taskmon.exe teekids.exe wincfg32.exe winsys.exe winupd.exe zapro.exe zonealarm.exe
Robak otwiera w przegl膮darce internetowej jedn膮 z poni偶szych stron:
nermasteno.com opsanted.com