W32/Mydoom.BL Worm

 Information about the W32/Mydoom.BL Worm:

W32/Mydoom.BL is a mass mailing worm. The worm will infect Windows systems and spreads through email.

The subject of the infected mail will be any one of the following;

Mail Transaction Failed
Server Report
Error
Document
Mail Delivery System
Hello
Readme
Status
Message

The body of the infected mail will be any one of the following;

Mail transaction failed. Partial message is available.

The message contains Unicode characters and has been sent as a binary attachment.

The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.

The name of the infected attachment will be any one of the following;

message
test
body
document
file
data
readme
doc

The extension of the infected attachment will be any of the following;

scr, bat, exe, pif or cmd.

Upon execution, the worm copies itself as microsystem.exe in Windows System folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

To propagate itself, the worm copies all available email address from Windows Address book.

It mails itself to these addresses using its own SMTP engine.

The worm also has the backdoor capabilities. It connects to the Internet Relay Chat (IRC) server. After the connection is established, it joins an IRC channel and listens for commands coming from a remote user.

This worm first appeared on April 8, 2006.

The worm also tries to terminate some of the security related processes.

 Other names of W32/Mydoom.BL Worm: