Name :	MyDoom.W
Category:	Malware
Type:	Backdoor, Email-Worm
Platform:	Win32

This is yet another new variant of MyDoom worm - Mydoom.W, was found on September 9th, 2004. This worm variant is very similar to previous variants: Mydoom.U and Mydoom.V. It spreads in e-mails with different subject and body texts, downloads and activates a backdoor.

The worm is a PE (Portable Executable) executable file 18432 bytes long packed with UPX file compressor. The unpacked file's size is over 44 kilobytes.

Installation to system

When run, the worm creates a mutex 'DDDDefaceDDDD', copies itself as WINDRV32.EXE to Windows System Directory and creates a startup key for that file in System Registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"WinSPF" = "%WinSysDir%\windrv32.exe"

where %WinSysDir% represents Windows System directory.

Additionally, the worm copies itself to the 'Start Menu\Programs\Startup\' folder of a current user as AUTOSTART.EXE file.

Spreading in e-mails

The worm spreads by sending its infected attachment to all e-mail addresses found on an infected computer. The worm looks for e-mail addresses in Windows Address Book (WAB) and in the files with the following extensions:

The worm avoids sending e-mails to e-mail addresses that contain any of the following substrings:

The subject of infected e-mails is selected from the following variants:

The body of infected e-mails is selected from the following variants:


The worm can send itself as an executable attachment or in a ZIP archive with one of the following names:


The worm can also attach a fake virus scan report to its message:

+++ Attachment: No Virus found +++

where can be any of the following:

Norton AntiVirus - www.symantec.de
F-Secure AntiVirus - www.f-secure.com
Norman AntiVirus - www.norman.com
Panda AntiVirus - www.pandasoftware.com
Kaspersky AntiVirus - www.kaspersky.com
MC-Afee AntiVirus - www.mcafee.com
Bitdefender AntiVirus - www.bitdefender.com
MessageLabs AntiVirus - www.messagelabs.com

The worm fakes the sender's address. It uses the following list of first names to compose the fake address:


It uses the following list of last names to compose the fake address:

It uses the following list of domain names to compose the fake address:

Downloading a backdoor

The worm downloads a backdoor from one of websites and activates it. The backdoor is known as 'Surila.I' or 'BackDoor-CEB.c' and is downloaded from the following websites:

Limited lifecycle

After September 20th, 2004, 01:18:31 the worm stops working and deletes its file from a hard drive.