A new variant of MyDoom worm - Mydoom.AE, was found on October 16th, 2004. The worm is similar to previous variants. It downloads and executes an additional file from a website. This file is detected as 'Worm.P2P.Scranor'. The Scranor P2P (peer-to-peer) worm in its turn downloads and runs another file, that is detected as 'Backdoor.Win32.Rbot.gen'. The MyDoom.AE worm has a message from Mydoom author(s) to AV vendors.
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
The worm is a PE executable file 51712 bytes long packed with UPX file compressor. The unpacked file's size is over 107 kilobytes.
When the worm's file is run, it first creates a mutex named 'My-Game'. Then the worm tries to download a file from the 'www.freewebs.com' website. This file is saved to the root folder of C: drive as 'Scran.exe' and is then activated. The downloaded file is a P2P (peer-to-peer) worm called 'Scranor'.
Upon installation the worm copies itself as 'avpr.exe' file to Windows System Directory and creates a startup key for that file in System Registry:
where "%WinSysDir%" represents Windows System directory. If the startup key cal not be created in HKLM (local machine) Registry tree, it is created in HKCU (current user) tree.
Also the worm creates the following key in the Registry:
The worm spreads by sending its infected attachment to all email addresses found on an infected computer. The worm looks for email addresses in Windows Address Book and in the files with the following extensions:
The worm searches for these files in the following locations:
The files are searched on hard disks and RAM drives from C: to Z:.
The worm avoids sending emails to email addresses that contain any of the following substrings:
The subject of infected emails is selected from the following variants:
The body text of infected emails is selected from the following variants:
The worm's attachment name is selected from the following variants:
The extension of an infected file can be any of the following:
MyDoom.AE worm can also send itself in a ZIP archive.
The worm can attach a fake anti-virus scanning report to the message it sends:
+++ Attachment: No Virus found
where <av_vendor_string> string can be one of the following:
The worm fakes the sender's address. It uses the following list of names to compose the fake address:
The worm uses the following list of domain names to compose the fake sender's address:
Upon installation the worm drops a file named 'TCP5424.dll' to Windows System folder. The following startup key is created in the Registry:
where "%WinSysDir%" represents Windows System directory. This DLL file is a backdoor that listens on TCP port 5424 for remote commands. The backdoor allows to upload and activate files on an infected computer.
The worm modifies the HOSTS file to block access to the following websites:
Additionally the worm creates the following keys from the Registry:
The worm contains a message to AV vendors in its body:
+++ Attachment: No Virus found
This message is extracted by the worm to Windows System folder as 'msg15.txt' file.