W32/Mydoom.AL Worm

 Information about the W32/Mydoom.AL Worm:

W32/Mydoom.AL is an email worm. This worm is a variant of W32/Mydoom. The worm will infect Windows systems. The worm spreads through email and ICQ instant messaging service.

The infected email carries a spoofed 'From' address picked up randomly from the infected system.

The subject of the infected mail will be any one of the following;

Me and you :)
Your friend lying to you..
Whoah! Very/-very big thing! Take a look!
Christmas ePostCard from
Sex in office, funny :]
Christmas card
You're next :) take a look
Office jokes /-))
Secret message
Christmas ePostCard
My girl, for your eyes only
Remember me?
Important, see attchmnt
Merry/-Christmas from
An e/-postcard is waiting for you
Party photos
My secret
Merry/-Christmas!
Look who's naked =)
For your eyes only!
Merry/-Christmas from
Hi again
Me again
Christmas Greeting Card Waiting For You
Is it your girl?
Find yourself on picture :/-D
Christmas Postcard!

The body of the infected mail will be any one of the following;

New Year Postcard from your friend
Happy New Year!
Postcard for you
Merry X/-Mas!
New Year Postcard from [random name]
Happy holidays! ;)

The name of the infected attachment will be any one of the following;

merry/-christmas
_joke
christmasscreenfrom
x/-mas joke
shitpix
flashepostcard
shit
fotos
photos
images
_nude
flash x/-mas game

The extension of the infected attachment will be any one of the following;

zip
exe
scr
pif
cpl

Upon execution, the worm copies itself as services.exe in the Windows System folder. This file runs as a service.

It alters the windows registry at the following location to load itself during next startup;

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services

The worm alters the hosts file to deny the access to few antivirus websites. It also terminates the several processes of antivirus software.

To propagate itself, the worm collects the available email addresses from the infected system and mails to those email addresses using its own SMTP engine.

This worm first appeared on 21st January, 2005.

 Other names of W32/Mydoom.AL Worm:

This Worm is also known as W32.Mydoom.AL@mm, WORM_MYDOOM.AL, W32/MyDoom-AL.