MyDoom prevention and cure

MyDoom is a mass-mailing worm that masquerades as a test message. It takes advantage of ZIP format's ability to pass through e-mail filters.

MyDoom is a mass-mailing worm that masquerades as a test message. MyDoom (w32.mydoom@mm, also known as Novarg, Shimgapi, Shimg, and MiMail.r) takes advantage of the ZIP file format's ability to pass through e-mail filters. It also uses Kazaa to spread.

HT Image

Within the first few hours, MyDoom spread quickly around the world. It affects only Windows users, not those using Macintosh, Linux, or Unix. Much of the worm's code is itself encrypted, and antivirus firms are still studying it. Because MyDoom spreads via e-mail and could severely slow or shut down e-mail servers with excess traffic, this worm rates a 7 on the CNET Virus Meter.

How it works

MyDoom arrives as e-mail with the subject line "Mail Delivery System," "Test," or "Mail Transaction Failed." The body text reads:
"The message contains Unicode characters and has been sent as a binary attachment." The attached files are one of the following:

document.zip

document.pif

doc.scr

When the worm is executed, MyDoom adds the following to the Windows/System subdirectory:

shimgapi.exe

taskmon.exe

If you are running the file-sharing program Kazaa, MyDoom will add a file named activation_crack.scr in this location: C:Program filesKazaaMy Shared Folder.

The worm appears to install programs on infected computers, however, the programs themselves are encrypted. MyDoom is known to open Windows Notepad and display garbage text; it is also thought to be flooding SCO.com with a denial-of-service attack. In addition, the security company iDefense and McAfee are reporting that MyDoom opens port 3127 to listen for commands from a remote attacker.

Prevention

If you receive MyDoom, do not open the attached file.

Delete the e-mail.

Removal

Almost all antivirus software companies have updated their signature files to include this worm. This will stop the infection upon contact and in some cases will remove an active infection from your system. For more information, see Central Command, Computer Associates, F-Secure, McAfee, Norman, Sophos, Symantec, or Trend Micro.