Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

Short description
Win32/Mydoom.CN is a worm that spreads via e-mail.
When executed, the worm creates the following files:
  • %system%\config\SERVICES
  • %system%\config\SERVICES.LOG
  • %system%\mstimer.dll (45056 B)
  • %system%\wversion.exe (32768 B)

The worm registers itself as a system service using the following name:
  • Windows Timer Service

The following Registry entries are created:
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
    "Description" = "Maintains date and time synchronization on all
    clients and server in the network. If this service is stopped,
    date and time synchronization will be unavailable. If this
    service is disabled, any services that explicitly depend on it
    will fail to start."
    "DisplayName" = "Windows Timer Service"
    "ErrorControl" = 1
    "ImagePath" = "%SystemRoot%\system32\svchost.exe -k mstimer"
Spreading via e-mail
E-mail addresses for further spreading are searched for in local files with one of the following extensions:
  • .txt
  • .pl
  • .html
  • .htm
  • .sht

The worm gathers e-mail addresses for further spreading by searching in the Windows Address Book (WAB).

Addresses containing the following strings are avoided:
  • root

Subject of the message is the following:
  • Memory Of...

Body of the message is the following:
  • last

The attachment is a/an RAR archive file containig an executable. The name of the attached file is following:
  • memory.rar

Other information
The worm tries to download several files from the Internet. The HTTP protocol is used.

These are stored in the following locations:
  • %system%\config\SERVICES
  • %system%\config\SERVICES.LOG
  • %temp%\~AX%random%.tmp

The files are then executed.

The following file is modified:
  • %windir%\win.ini

The worm may create the following files:
  • ~SDSTY.bat
  • %temp%\~AX%random%.tmp