Softpanorama

May the source be with you, but remember the KISS principle ;-)
Home Switchboard Unix Administration Red Hat TCP/IP Networks Neoliberalism Toxic Managers
(slightly skeptical) Educational society promoting "Back to basics" movement against IT overcomplexity and  bastardization of classic Unix

Malware Defense History

by Dr. Nikolai Bezroukov.

Copyright: Dr. Nikolai Bezroukov 1994-2013. Unpublished notes. Version 0.80.October, 2013

Contents : Foreword : Ch01 : Ch02 : Ch03  : Ch04 : Ch05 : Ch06 : Ch07 : Ch08 : Ch09 : Ch10 : Ch11 : Ch12 : Ch13


Chapter 6: Mail Worms

Mydoom Worm

01/26/2004

Adapted from Symantec site:

This is a mass-mailing and peer-to-peer file-sharing worm that bears the following characteristics:

If you think that you may be infected with Mydoom, and are unsure how to check your system, you may download the Stinger tool to scan your system and remove the virus if present.  This is not required for McAfee users as McAfee products are capable of detecting and removing the virus with the latest update. (see the removal instructions below for more information).

Note: Receiving an email alert stating that the virus came from your email address is not an indication that you are infected as the virus often forges the from address. 

The virus arrives in an email message as follows:

From: (Spoofed email sender)
Subject: (Varies, such as)

Body:  (Varies, such as) 

Attachment: (varies [.bat, .exe, .pif, .cmd, .scr] - often arrives in a ZIP archive) (22,528 bytes)

In the case of two file extensions, multiple spaces may be inserted as well, for example:

The icon used by the file tries to make it appear as if the attachment is a text file:

Note: Do not assume that the sender address is an indication that the sender is infected.  Additionally you may receive alert messages from a mail server that you are infected, which may not be the case.

When this file is run (manually), it copies itself to the WINDOWS SYSTEM directory as taskmon.exe

(Where %Sysdir% is the Windows System directory, for example C:\WINDOWS\SYSTEM)

It creates the following registry entry to hook Windows startup:

The virus uses a DLL that it creates in the Windows System directory:

This DLL is injected into the EXPLORER.EXE upon reboot via this registry key:

The virus will not replicate on the 12th February or later (although the DLL will still be installed).

Peer To Peer Propagation
The worm copies itself to the KaZaa Shared Directory with the following filenames:

Remote Access Component
The worm (this functionality is in the dropped DLL) opens a connection on TCP port 3127 (if that fails it opens next available port up to port 3198). The worm can accept specially crafted TCP transmissions.

Denial of Service Payload
On the first system startup on February 1st or later, the worm changes its behavior from mass mailing to initiating a denial of service attack against www.sco.com. This denial of service attack will stop on the first system startup of February 12th or later, and thereafter the worm's only behavior is to continue listening on TCP port 3127

This worm tries to spread via email and by copying itself to the shared directory for Kazaa clients if they are present.

The mailing component harvests address from the local system.  Files with the following extensions are targeted:

The worm avoids certain address, those using the following strings:

Additionally, the worm contains strings, which it uses to randomly generate, or guess, email addresses. These are prepended as user names to harvested domain names:

Finally the virus sends itself via SMTP - constructing messages using its own SMTP engine.  The worm guesses the recipient email server, prepending the target domain name with the following strings:

Removal Instructions
All Users :
Use specified engine and DAT files for detection and removal.

The shimgapi.dll file is injected into the EXPLORER.EXE process if the system has been rebooted after the infection has occured.  In this situation, a reboot and rescan is required to remove this DLL from the system with the 4319 DAT files.  The 4320 DAT files, and later, do not require a reboot.

Alternatively, following EXTRA.DAT packages are available.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

Additional Windows ME/XP removal considerations

Stinger
Stinger 1.9.8 has been made available to assist in detecting and repairing this threat.  A reboot is not required after running Stinger v 1.9.8.

Manual Removal Instructions
To remove this virus "by hand", follow these steps (WinNT/2K/XP):

  1. Terminate the process TASKMON.EXE
  2. Delete the file TASKMON.EXE from your WINDOWS SYSTEM directory (typically c:\windows\system32 or c:\winnt\system32)
  3. Edit the registry
    • Delete the "TaskMon" value from
      • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
        Windows\CurrentVersion\Run
    • Change the (Default) value to webcheck.dll here
      • HKEY_CLASSES_ROOT\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32
  4. Terminate the process EXPLORER.EXE
  5. From the WINDOWS TASK MANAGER, click FILE - RUN, type EXPLORER.EXE and hit ENTER.
  6. Delete the file SHIMGAPI.DLL your WINDOWS SYSTEM directory (typically c:\windows\system32 or c:\winnt\system32)
  7. Reboot the system

McAfee Security Desktop Firewall
To prevent possible remote access McAfee Desktop Firewall users can block incoming TCP port 3127.

Sniffer Customers: Filters have been developed that will look for MyDoom traffic [Sniffer Distributed 4.1/4.2/4.3, Sniffer Portable 4.7/4.7.5, and Netasyst].

ThreatScan users
The latest ThreatScan signature (2004-01-27) includes detection of the Mydoom virus. This signature is available for ThreatScan v2.0, v2.1, and v2.5.

ThreatScan users can also detect the backdoor portion of the virus by running a "Resource Discovery" task utilizing the port scanning options.

To update your ThreatScan installations with the latest signatures perform the following tasks:

  • From within ePO open the "Policies" tab.
  • Select "McAfee ThreatScan" and then select "Scan Options"
  • In the pane below click the "Launch AutoUpdater" button.
  • Using the default settings proceed through the dialogs that appear. Upon successful completion of the update a message will appear stating that; update 2004-01-27 has completed successfully.
  • From within ePO create a new "AutoUpdate on Agent(s)" task.
  • Go into the settings for this task and ensure that the host field is set to ftp.nai.com , the path is set to /pub/security/tsc20/updates/winnt/ and that the user and password fields are both set to ftp. Note that "tsc20" in the above path is used for ThreatScan 2.0 and 2.1. The correct path for ThreatScan 2.5 is "tsc25".
  • Launch this task against all agent machines.
  • When the task(s) complete information will be available in the "Task Status Details" report.

    To create and execute a new task containing the new update functionality, do the following:

    • - Create a new ThreatScan task.
    • - Edit the settings of this task.
    • - Edit the "Task option", "Host IP Range" to include all desired machines to scan.

    To scan for the virus:

    • Select the "Remote Infection Detection" category and "Windows Virus Checks" template. -or-
    • Select the "Other" category and "Scan All Vulnerabilities" template.

    To create and execute a new task to perform a port scan, do the following:

  • Create a new Resource Discovery task.
  • Edit the settings of this task.
  • Edit the "Task option", "Host IP Range" to include all desired machines to scan.
  • To scan for the virus:

    • Select the "Port Scan" option.
    • Select the "TCP Port Scan" option.
    • Enter 3127 in the "TCP Port Ranges" field.
    • Launch the scan.

    For additional information:

    • Run the "ThreatScan Template Report"
    • Look for module number #4061
Aliases
Novarg (F-Secure)
W32.Novarg.A@mm (Symantec)
W32/Mydoom.a@MM
Win32.Mydoom.A (CA)
Win32/Shimg (CA)
WORM_MIMAIL.R (Trend)

 


Etc

Society

Groupthink : Two Party System as Polyarchy : Corruption of Regulators : Bureaucracies : Understanding Micromanagers and Control Freaks : Toxic Managers :   Harvard Mafia : Diplomatic Communication : Surviving a Bad Performance Review : Insufficient Retirement Funds as Immanent Problem of Neoliberal Regime : PseudoScience : Who Rules America : Neoliberalism  : The Iron Law of Oligarchy : Libertarian Philosophy

Quotes

War and Peace : Skeptical Finance : John Kenneth Galbraith :Talleyrand : Oscar Wilde : Otto Von Bismarck : Keynes : George Carlin : Skeptics : Propaganda  : SE quotes : Language Design and Programming Quotes : Random IT-related quotesSomerset Maugham : Marcus Aurelius : Kurt Vonnegut : Eric Hoffer : Winston Churchill : Napoleon Bonaparte : Ambrose BierceBernard Shaw : Mark Twain Quotes

Bulletin:

Vol 25, No.12 (December, 2013) Rational Fools vs. Efficient Crooks The efficient markets hypothesis : Political Skeptic Bulletin, 2013 : Unemployment Bulletin, 2010 :  Vol 23, No.10 (October, 2011) An observation about corporate security departments : Slightly Skeptical Euromaydan Chronicles, June 2014 : Greenspan legacy bulletin, 2008 : Vol 25, No.10 (October, 2013) Cryptolocker Trojan (Win32/Crilock.A) : Vol 25, No.08 (August, 2013) Cloud providers as intelligence collection hubs : Financial Humor Bulletin, 2010 : Inequality Bulletin, 2009 : Financial Humor Bulletin, 2008 : Copyleft Problems Bulletin, 2004 : Financial Humor Bulletin, 2011 : Energy Bulletin, 2010 : Malware Protection Bulletin, 2010 : Vol 26, No.1 (January, 2013) Object-Oriented Cult : Political Skeptic Bulletin, 2011 : Vol 23, No.11 (November, 2011) Softpanorama classification of sysadmin horror stories : Vol 25, No.05 (May, 2013) Corporate bullshit as a communication method  : Vol 25, No.06 (June, 2013) A Note on the Relationship of Brooks Law and Conway Law

History:

Fifty glorious years (1950-2000): the triumph of the US computer engineering : Donald Knuth : TAoCP and its Influence of Computer Science : Richard Stallman : Linus Torvalds  : Larry Wall  : John K. Ousterhout : CTSS : Multix OS Unix History : Unix shell history : VI editor : History of pipes concept : Solaris : MS DOSProgramming Languages History : PL/1 : Simula 67 : C : History of GCC developmentScripting Languages : Perl history   : OS History : Mail : DNS : SSH : CPU Instruction Sets : SPARC systems 1987-2006 : Norton Commander : Norton Utilities : Norton Ghost : Frontpage history : Malware Defense History : GNU Screen : OSS early history

Classic books:

The Peter Principle : Parkinson Law : 1984 : The Mythical Man-MonthHow to Solve It by George Polya : The Art of Computer Programming : The Elements of Programming Style : The Unix Hater’s Handbook : The Jargon file : The True Believer : Programming Pearls : The Good Soldier Svejk : The Power Elite

Most popular humor pages:

Manifest of the Softpanorama IT Slacker Society : Ten Commandments of the IT Slackers Society : Computer Humor Collection : BSD Logo Story : The Cuckoo's Egg : IT Slang : C++ Humor : ARE YOU A BBS ADDICT? : The Perl Purity Test : Object oriented programmers of all nations : Financial Humor : Financial Humor Bulletin, 2008 : Financial Humor Bulletin, 2010 : The Most Comprehensive Collection of Editor-related Humor : Programming Language Humor : Goldman Sachs related humor : Greenspan humor : C Humor : Scripting Humor : Real Programmers Humor : Web Humor : GPL-related Humor : OFM Humor : Politically Incorrect Humor : IDS Humor : "Linux Sucks" Humor : Russian Musical Humor : Best Russian Programmer Humor : Microsoft plans to buy Catholic Church : Richard Stallman Related Humor : Admin Humor : Perl-related Humor : Linus Torvalds Related humor : PseudoScience Related Humor : Networking Humor : Shell Humor : Financial Humor Bulletin, 2011 : Financial Humor Bulletin, 2012 : Financial Humor Bulletin, 2013 : Java Humor : Software Engineering Humor : Sun Solaris Related Humor : Education Humor : IBM Humor : Assembler-related Humor : VIM Humor : Computer Viruses Humor : Bright tomorrow is rescheduled to a day after tomorrow : Classic Computer Humor

The Last but not Least Technology is dominated by two types of people: those who understand what they do not manage and those who manage what they do not understand ~Archibald Putt. Ph.D


Copyright © 1996-2021 by Softpanorama Society. www.softpanorama.org was initially created as a service to the (now defunct) UN Sustainable Development Networking Programme (SDNP) without any remuneration. This document is an industrial compilation designed and created exclusively for educational use and is distributed under the Softpanorama Content License. Original materials copyright belong to respective owners. Quotes are made for educational purposes only in compliance with the fair use doctrine.

FAIR USE NOTICE This site contains copyrighted material the use of which has not always been specifically authorized by the copyright owner. We are making such material available to advance understanding of computer science, IT technology, economic, scientific, and social issues. We believe this constitutes a 'fair use' of any such copyrighted material as provided by section 107 of the US Copyright Law according to which such material can be distributed without profit exclusively for research and educational purposes.

This is a Spartan WHYFF (We Help You For Free) site written by people for whom English is not a native language. Grammar and spelling errors should be expected. The site contain some broken links as it develops like a living tree...

You can use PayPal to to buy a cup of coffee for authors of this site

Disclaimer:

The statements, views and opinions presented on this web page are those of the author (or referenced source) and are not endorsed by, nor do they necessarily reflect, the opinions of the Softpanorama society. We do not warrant the correctness of the information provided or its fitness for any purpose. The site uses AdSense so you need to be aware of Google privacy policy. You you do not want to be tracked by Google please disable Javascript for this site. This site is perfectly usable without Javascript.

Last modified: March 12, 2019