How to delete Mydoom.m - Removal tool, fix instructions

Name: Mydoom.m

Aliases: I-Worm.Mydoom.m, Mydoom.N, WORM_MYDOOM.M, W32/MyDoom-O

Type: Worm

Size: -

First appeared on: 26.07.2005

Damage: Medium

Brief Description:
Mydoom.M installs a file that behaves as a backdoor by opening the TCP port 1034 and listens to it. By doing so, it allows hackers to remotely access the affected computer in order to carry out actions that would compromise users confidentiality or impede normal work.

Mydoom.M spreads via e-mail in a message with variable characteristics

Visible Symptoms:

Mydoom.M is very difficult to recognize, as it does not display any messages or warnings that indicate it has reached the computer.

Technical description:

Mydoom.M is a mass-mailing worm which spreads by emailing itself via its own SMTP engine. The worm also allows unauthorised remote access to the computer via a network. When first run the worm copies itself to either the Windows or Temp folders as java.exe and adds one of the following registry entries to ensure that the copy is run each time Windows starts:

HKLM\Software\Microsoft \ Windows\CurrentVersion\Run\JavaVM
HKCU\Software\Microsoft \ Windows\CurrentVersion\Run\JavaVM
HKLM\Software\Microsoft \ Windows\CurrentVersion\Run\Services
HKCU\Software\Microsoft \ Windows\CurrentVersion\Run\Services

Mydoom.M also creates a file named services.exe in the Windows or Temp folder and runs the file. Services.exe is the backdoor component of Mydoom.M.

Mydoom.M searches the hard disk email addresses. The worm searches files with the extensions PL*, PH*, TX*, HT*, ASP, TBB, SHT*, WAB, ADB and DBX and the Windows address book. In addition the worm may use an internet search engine to find more email addresses. The worm will send a query to the search engine using domain names from email addresses found on the hard disk and then examine the query results, searching for more addresses. The internet search engines used by Mydoom.M and the percentage chance that each is used are:

www.google.com (45%)
search.lycos.com (22.5%)
search.yahoo.com (20%)
www.altavista.com (12.5%)

Propagation:

Mydoom.N spreads via e-mail. In order to do so, it follows the routine below:

It reaches the computer in an e-mail message with variable characteristics:

Sender's address: (either chosen from the list below or spoofed):

  • MAILER-DAEMON
  • Mail Administrator
  • Automatic Email Delivery Software
  • Post Office
  • The Post Office
  • Bounced mail
  • Returned mail
  • Mail Delivery Subsystem

Message header (chosen at random from the list below):

  • Message could not be delivered
  • hello
  • Hi
  • error
  • status
  • test
  • report
  • delivery failed
  • Message could not be delivered
  • Mail System Error - Returned Mail
  • Delivery reports about your e-mail
  • Returned mail: see transcript for details
  • Returned mail: Data format error
  • {{The|Your} m|M}essage could not be delivered
  • instruction

Message body (chosen at random from the list below)

The message body will be altered to correspond to the user's details.

  • Dear user {$t|of $T},{ {{M|m}ail {system|server} administrator|administration} of $T would like to {inform you{ that{:|,}|}|let you know {that|the following}{.|:|,}}|||||}
  • {We have {detected|found|received reports} that y|Y}our {e{-|}mail |}account {has been|was} used to send a {large|huge} amount of {{unsolicited{ commercial|}|junk} e{-|}mail|spam}{ messages|} during { this|the {last|recent}} week.
  • {We suspect that|Probably,|Most likely|Obviously,} your computer {had been|was} {compromised|infected{ by a recent v{iru}s|}} and now {run|contain}s a {trojan{ed|}|hidden} proxy server.
  • {Please|We recommend {that you|you to}} follow {our |the |}instruction{s|} {in the {attachment|attached {text |}file} |}in order to keep your computer safe.
  • {{Virtually|Sincerely} yours|Best {wishe|regard}s|Have a nice day}, {$T {user |technical |}support team.|The $T {support |}team.}
  • {The|This|Your} message was{ undeliverable| not delivered} due to the following reason{(s)|}:
  • Your message {was not|could not be} delivered because the destination {computer|server} was {not |un}reachable within the allowed queue period. The amount of time a message is queued before it is returned depends on local configuration parameters.
  • Most likely there is a network problem that prevented delivery, but it is also possible that the computer is turned off, or does not have a mail system running right now.
  • Your message {was not|could not be} delivered within $D days: {{{Mail s|S}erver}|Host} $i is not responding.
  • The following recipients {did|could} not receive this message: <$t>
  • Please reply to postmaster@{$F|$T} if you feel this message to be in error. The original message was received at $w{ | }from {$F [$i]|{$i|[$i]}}
  • ----- The following addresses had permanent fatal errors ----- {<$t>|$t}
  • {----- Transcript of {the ||}session follows ----- ... while talking to {host |{mail |}server ||||}{$T.|$i}: {>>> MAIL F{rom|ROM}:$f <<< 50$d {$f... |}{Refused|{Access d|D}enied|{User|Domain|Address} {unknown|blacklisted}}|554 <$t>..
  • . {Mail quota exceeded|Message is too large} 554 <$t>... Service unavailable|550 5.1.2 <$t>... Host unknown (Name server: host not found)|554 {5. 0.0 |}Service unavailable; [$i] blocked using {relays.osirusoft.com|bl.spamcop.net}{, reason: Blocked|} Session aborted{, reason: lost connection|}|>>> RCPT To:<$t> <<< 550 {MAILBOX NOT FOUND|5.1.1 <$t>... {User unknown|Invalid recipient|Not known here}}|>>> DATA {<<< 400-aturner; %MAIL-E-OPENOUT, error opening !AS as output|}{<<< 400-aturner; -RMS-E-CRE, ACP file create failed|}{<<< 400-aturner; -SYSTEM-F-EXDISKQUOTA, disk quota exceeded|}<<< 400}|} The original message was included as attachment {{The|Your} m|M}essage could not be delivered

Attachment name:

The attachment name is generated at random.

Attachment extension (chosen at random from the list below):

  • cmd
  • bat
  • com
  • pif
  • scr
  • doc
  • exe

The worm may also be sent in the form of a ZIP archive.

Removal tool and instruction:
Not available