Name :	MyDoom.V
Category:	Malware
Type:	Email-Worm
Platform:	Win32

Another new variant of MyDoom worm - Mydoom.V, was found on September 9th, 2004. This worm variant is very similar to previous variant: Mydoom.U. It spreads in e-mails with different subject and body texts, downloads and activates a backdoor.

The worm is a PE executable file 18200 bytes long packed with UPX file compressor. The unpacked file's size is over 44 kilobytes.

Installation to system

When run, the worm creates a mutex 'WWWdefacedWWW', copies itself as WINDRV32.EXE to Windows System Directory and creates a startup key for that file in System Registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"WinSPF" = "%WinSysDir%\windrv32.exe"

where %WinSysDir% represents Windows System directory.

Additionally the worm copies itself to the 'Start Menu\Programs\Startup\' folder of a current user as AUTOSTART.EXE file.

Spreading in e-mails

The worm spreads by sending its infected attachment to all e-mail addresses found on an infected computer. The worm looks for e-mail addresses in Windows Address Book and in the files with the following extensions:

• avp.
• syman
• icrosof
• panda
• sopho
• borlan
• inpris
• example
• mydomai
• nodomai
• ruslis
• icrosoft
• .gov
• gov.
• .mil
• @foo.
• @iana
• spam
• unix
• linux
• kasp
• antivi
• messagelabs
• support
• berkeley
• unix
• math
• mit.e
• gnu
• fsf.
• ibm.com
• google
• kernel
• linux
• fido
• usenet
• iana
• ietf
• rfc-ed
• sendmail
• arin.
• ripe.
• isi.e
• isc.o
• secur
• acketst
• pgp
• tanford.e
• utgers.ed
• mozilla
• icq.com
• admin
• icrosoft
• support
• ntivi
• unix
• bsd
• linux
• listserv
• certific
• google
• accoun
• abuse
• upport
• www
• root
• info
• samples
• postmaster
• rating
• root
• news
• webmaster
• noone
• noreply
• nobody
• nothing
• anyone
• someone
• rating
• site
• contact
• support
• somebody
• privacy
• service
• help
• submit
• feste
• gold-certs