W32/MyDoom-BH a.k.a. W32.Mydoom.BG@mm

Randy_Bell · Mar 21, 2005

Sophos: W32/MyDoom-BH

W32/MyDoom-BH is a mass-mailing and peer-to-peer worm.

When first run the worm will display a dialog box with the title "AVToolKitPro" and message of "Operation completed". The worm will then copy itself to the Windows system folder as debugmonitor.exe and create the following registry entry so as to auto-start:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DebugMonitor
%SYSTEM%\debugmonitor.exe

The worm will also attempt to copy itself to the KaZaa share folder if it exists using one of the following filenames and an extension chosen from PIF, SCR, EXE or BAT:

nuke2004
office_crack
rootkitXP
strip-girl-2.0bdcom_patches
activation_crack
icq2004-final
winamp5

W32/MyDoom-BH will harvest email address from files on the local drives with the following extensions:

WAB PL ADB TBB DBX ASP PHP SHT HTM TXT

Emails sent by the worm are in HTML and may take the following form:

Subject:

Virus Alert id: <random number>

Message text:

You received this message as a valuable
Symantec.com member since September 23, 2003.
************************************************************
WARNING! Your computer was infected by VIRUS:
Worm.SomeFool.P
You can install this utility to remove virus
************************************************************
http://securityresponse.<BLOCKED>tec.com/avcenter/FxAgentB.exe

W32/MyDoom-BH may also attempt do download and execute components from remote webistes.
Click to expand...

See also Symantec: W32.Mydoom.BG@mm

Randy_Bell · Mar 21, 2005

VSAntivirus {English transl}: W32/Mydoom.BG

Computer Associates: Win32.Mydoom.BI

TrendMicro: WORM_MYDOOM.AT

Log in or Sign up

W32/MyDoom-BH a.k.a. W32.Mydoom.BG@mm

Randy_Bell Registered Member

Randy_Bell Registered Member

Log in or Sign up

W32/MyDoom-BH a.k.a. W32.Mydoom.BG@mm

Randy_Bell Registered Member

Randy_Bell Registered Member

Useful Searches