Article
According to the latest news sources (as well as all of our inboxes), a new worm is out and about on the internet. But this time, it's a worm that goes by the names "Mydoom," "Novarg" and "WORM_MIMAIL.R".
Instead of exploiting bugs in Microsoft's Outlook, this time the bug seems to be exploiting people's gullibility. Yes, that's right, this is another attachment based virus.
However, even technical people may get duped by this virus. You won't find any of the common worm captions enticing you to click on attachments to see hot women or innocent bunnies hopping across your screen.
Instead, the worm displays random titles like, "Delivery System", "Mail Transaction Failed", or "Test".
Some examples of the text body include:
"The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment."
"The message contains Unicode characters and has been sent as a binary attachment."
"Mail transaction failed. Partial message is available."
The overall effect of these messages is that users will think that they are looking at a legitimate error and need to click on the button for the "real" attached message.
The attached file is 22,528 bytes (22K) and ends with one of the following extensions: .exe, .scr, .zip, .cmd, or .pif.
When this file is run it copies itself to the local system with the following filenames: c:\Program Files\KaZaA\My Shared Folder\activation_crack.scr c:\WINDOWS\SYSTEM\taskmon.exe
It also uses a DLL that it creates in the Windows System directory:
c:\WINDOWS\SYSTEM\shimgapi.dll (4,096 bytes)
It creates the following registry entry to hook Windows startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\ CurrentVersion\Run "TaskMon" = %SysDir%\taskmon.exe
The worm opens a connection on TCP port 3127 which suggests remote access capabilities.
For more details on MyDoom, click here.