Selected viruses, spyware, and other threats: sorted alphabetically
Short descriptionWin32/Mydoom.CN is a worm that spreads via e-mail.
InstallationWhen executed, the worm creates the following files:
- %system%\mstimer.dll (45056 B)
- %system%\wversion.exe (32768 B)
The worm registers itself as a system service using the following name:
- Windows Timer Service
The following Registry entries are created:
"Description" = "Maintains date and time synchronization on all
clients and server in the network. If this service is stopped,
date and time synchronization will be unavailable. If this
service is disabled, any services that explicitly depend on it
will fail to start."
"DisplayName" = "Windows Timer Service"
"ErrorControl" = 1
"ImagePath" = "%SystemRoot%\system32\svchost.exe -k mstimer"
Spreading via e-mailE-mail addresses for further spreading are searched for in local files with one of the following extensions:
The worm gathers e-mail addresses for further spreading by searching in the Windows Address Book (WAB).
Addresses containing the following strings are avoided:
Subject of the message is the following:
- Memory Of...
Body of the message is the following:
The attachment is a/an RAR archive file containig an executable. The name of the attached file is following:
Other informationThe worm tries to download several files from the Internet. The HTTP protocol is used.
These are stored in the following locations:
The files are then executed.
The following file is modified:
The worm may create the following files: