Zindos

Threat description

Details

CATEGORYMalware
TYPEWorm, Net-Worm

Summary

The Zindos worm used the backdoor that was installed by the Mydoom.M worm, that spread earlier. Since Zindos had no other infection vector, so it could only spread to computers that were infected with Mydoom.M earlier. It even used a list of infected computers, collected by Mydoom. I suppose the idea was to use the mass-mailing worm to pave way to the payload for rapid distribution later. The Zindos code had not much to do, just go straight through the list of already compromised computers and copy itself there through the backdoor. Zindos is a network worm which spreads with the help of the Mydoom.M mass-mailing worm. For more information, see Mydoom.M.



Removal

Automatic action

Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.

More scanning & removal options

More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.

Technical Details

Mydoom.M plants a backdoor that scans for other systems with the same backdoor. Zindos uses the backdoor and its target list to spread. The payload is a Distributed Denial-of-Service (DDOS) attack against www.microsoft.com.

System Infection

Zindos first arrives through the Mydoom.M backdoor. When uploaded to the victim, the worm file is dropped to the TEMP folder with a random name. The file is added to the registry as either of

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]   "Tray" = "%TEMP%\.exe"   
Propagation

To propagate Zindos uses the list of compromised computers collected by the Mydoom.M backdoor. The worm goes through the list and uploads itself with the corresponding command through the backdoor.

Payload

The payload of Zindos is a Distributed Denial-of-Service routine that downloads http://www.microsoft.com/ in an infinite loop with 50ms delays.

Description Created: 2006-01-01 11:02:00.0

Description Last Modified: 2006-01-01 00:00:00.0

Submit a Sample

Suspect a file or URL was wrongly detected?
Send it to our Labs for further analysis

Submit a Sample

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

More Info