Several variants of Mydoom distributed globally
The end of the workweek saw the emergence of the four variants from the notorious MyDoom family. The distribution of several modifications of the same virus at once suggests the virus writers exploit the Web users to perfect their skills for future more serious threat release, as it was, for example, in case with Beagle.
It seems like virus creators are in search for new jobs. Anyhow, the line embedded into the viral body of the first of the MyDooms says exactly about it.
We searching 4 work in AV industry.
All four MyDom offsprings resemble of twins, with only minor distinctions between them. Traditionally, the sender’s address is spoofed by the worm. The sender’s name is a combination of a commonplace name and surname and can be “Parker", "Adams", "Rodriguez", "Michael" etc. The senders’ s domain name is selected from cox.net yahoo.com, @msn.com, @yahoo.co.uk, @t-online.de, @gmx.net, @hotmail.com, @aol.com, @mail.com, @dailymail.co.uk.
The subjects present the coming message sometimes as if it is a screen saver (screensaverlol!), sometimes as if a cleaning utility against some virus (Virus removal tool), sometimes they threaten legitimate users their computers got infected - You are infected by virus. Run this exe apply this patch! apply patch.
As usual, the titles of the most message are neutral in order not to arouse a slightest suspicion that an infection is hidden inside:
See the file.
See attached file for details.
Monthly news report.
To more confuse the recipients of such messages most of them bear signatures of known antivirus companies.
Remember, antivirus companies never distribute cleaning utilities against viruses via email! Dr.Web® antivirus program has its own embedded curing mechanism of the infected system and special curing utilities have never been produced.
The attachments names are quite trivial and may sound like «antivirus.exe», «patch.exe», «new.exe», «photo.exe», «bill.zip». Their extensions can be .exe, src, or .zip. Some attachments have double extensions with multiple blanks between them, for example,
Message.html .pif
mesg.rtf .pif
The first extension has the aim to make a false feeling the enclosed file is harmless while the secondary attachment following the first one, which can be .doc, rtf, or html, explicitly signifies the attachment contains an executable file. Still, in most cases users do not see this extension, as it is not displayed by default.
Having penetrated a system the virus, first of all, tries to send its copies via email using mail addresses harvested in the infected machine. It is a really mass distribution, as the worms create several parallel threads in order to establish connection with SMTP-server the name of which can be found on the system and to send messages with the infected attachments to a large list of recipients.
To secure their future launches at every system startup the worms make their copies in the System folder and write themselves to Start Menu\Programs\Startup\ \USERPROFILE. When in a system, they download from the Internet and run in the computer files which are Trojanized utilities, enabling malefactors to gain a remote access to infected PCs.
See, for example, the list of correspondent URLs from the Win32.HLLM.MyDoom.34816 body.
http://www.mer.....s.de/html/content/guestbook/data/data2.dat
http://69.93....6/blood.gif http://64.40.98.94/icon/icon.exe
http://www......it/forumBB/postmsg.gif
http://www.......com/adclik/click.dat
http://www.ma.....work.com/heyyo/wassup/00000008.cgi
Curiously, but even two days after the appearance of the worm some of these URLs are still active and are atill the source of Trojan programs (detected by Dr.Web® as Trojan.MulDrop.973).
All new MyDoom variants of this week have been immediately added to Dr.Web® virus definition database. In case of infection launching Dr.Web antivirus scanner allows to neutralize the worms and to delete them from systems. SpiderMail antivirus mail filter will prevent a mass distribution of infected messages even before the virus base is updated on the infected computer.
Other news
|
 |
My five cents
|
 |
| |
What is the screen size of your monitor?
|
 |
|
 |
|
 |
|
