W32/Mydoom.Q Worm

 Information about the W32/Mydoom.Q Worm:

W32/Mydoom.Q is a mass mailing worm. This worm is a variant of W32/Mydoom. The worm will infect Windows systems and spreads through email.

The infected email carries a spoofed 'From' address having any of the following strings:

jennifer
jessica
pamela
robert
susan
sarah
nancy
mike
john
joe
eric
linda
kevin
mary
jason
david
karen
daniel
patricia
barbara

The worm arrives with the following subject:

Re: hello (Secure-Mail)
Re: Extended Mail
failed transaction
Re: Server Reply
Secure delivery
SN: Server Status
SN: New secure mail
Delivery Status (Secure)

The body of the infected mail will be a combination of Part A, Part B and Part C:

Part A:

<domain-name> :: Automatically Secure Delivery: for <email address >
<domain-name> :: Mail Delivery Server System: for <email address >
<domain-name> :: Extended secure mail message available at: <email address >
<domain-name> :: Secure Mail Server Notification: for <email address >
<domain-name> :: New mail secure method implement: for <email address >

Part B:

New policy recommends to enclose all messages as Zip format. Your message is available in this server notice.
For security measures this message has been packed as Zip format. This is a newly added security feature.
This message is available as a secure Zip file format due to a new security policy.
Now a new message is available as secure Zip file format. Due to new policies on clients.
New policy requested by mail server to returned mail as a secure compiled attachment (Zip).
You have received a message that implements secure delivery technology. Message available as a secure Zip file.

Part C:

This message is an automatically server notice from Administration at <domain-name>.
Server Notice: New security feature added. MSG:ID: 455sec86 from <domain-name>.
New feature added for security reasons from <domain-name>.
Automatically server notice:, Server reply from <domain-name>.
New service policy for security added from <domain-name>.

The infected email carries any one of the following attachments;

transcript
document
text
file
mail
readme
message
attachment

The extension of the attachment will be any one of the following;

.exe
.zip
.txt.scr
.txt.exe
.htm.exe

Upon execution, the worm copies itself as winlibs.exe to Windows System folder.

It also alters the windows registry at the following location to load itself during next startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

To propagate itself, the worm scans the following extensions and collects the available email addresses from the infected system;

.shtml, .shtm, .xml, .wab, .txt, .tbb, .sht, .php, .ods, .pl, .js, .msg, .mmf, .jsp, .jse, .htm, .eml, .dbx, .cfg, .asp, .adb, .dhtm, .html,

The worm mails itself to these addresses using its own SMTP engine. It also uses Yahoo People Search to collect more email addresses.

This worm first appeared on 3rd August, 2004.

 Other names of W32/Mydoom.Q Worm:

This worm is also known as W32/Mydoom.Q@MM, WORM_MYDOOM.Q, W32/MyDoom-Q, MyDoom.Q.