W32/Mydoom.S Worm

 Information about the W32/Mydoom.S Worm:

W32/Mydoom.S is a mass mailing worm. This worm is a variant of W32/Mydoom. The worm will infect Windows systems and spreads through email.

It arrives with the following subject:

photos

The body of the infected mail will be:

LOL!;))))

The infected mail carries an attachment, photos_arc.exe.

Upon execution, the worm copies itself as rasor38a.dll to Windows folder and winpsd.exe to Windows System folder.

It also alters the windows registry at the following location to load itself during next startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The worm tries to download a backdoor from various websites. It saves the file as winvpn32.exe in the Windows folder and executes it. The worm scans the following extensions and collects the available email addresses from the infected system;

.wab, .txt, .tbb, .sht, .php, .htm, .dbx, .asp, .adb.

The worm mails itself to these addresses using its own SMTP engine.

This worm first appeared on 16th August, 2004.

 Other names of W32/Mydoom.S Worm:

This worm is also known as WORM_RATOS.A, W32/MyDoom-S, MyDoom.S.

Click here to download a 30 day Evaluation Copy of
Protector Plus for your operating system