W32/Mydoom.T Worm

 Information about the W32/Mydoom.T Worm:

W32/Mydoom.T is an email worm. This worm is a variant of W32/Mydoom Worm. The worm will infect Windows systems. The worm spreads through email and KaZaA P2P software.

The infected email carries a spoofed 'From' address picked up randomly from the infected system.

The worm arrives with any one of the following subject:

<none>
hi
test
hello
Error
readme
Status
RE:test
message
document
<Garbage>
RE:my .....
Server Repor
Mail Transac
Mail Deliver
Information

The body of the infected mail will be any one of the following:

hello.
check.
hello :)
loooooool ;)))
come back my friend.
your attachment , thx.
error to send the mail!!!!!.
here is what you need,thx.
!!!!!!!!!!!, check the attachment!!!.
hello check the attachment thx.
Try Later, Check the Attachment.
the attachment for more information.
Check the attachment for more information!.
check the attachment to get the lastest news.
failed,check the attachment for more information.
error, check the attachment for more information.
you can check the attachment for more information.
(Norton ANti Virus,Panda,Mcafee No Virusses Found).
Mail transaction failed. Partial message is available.
error, sorry we can't send the email so check the attachment.
failed to send the email!, check the attachment for more information.
sorry we can't send the mail try later, check the attachment for more information.
Norton Anti Virus : No Virusses Found , Check The Attachment For More Information.

The name of the infected attachment will be any one of the following;

file
doc
test
text
msg
data
body
error
readme
message
document
information
<a random name>

The extension of the infected attachment will be any one of the following;

cmd
bat
pif
scr
exe

Upon execution, the worm copies itself as tasker.exe on to the Windows System32 folder. It also drops nemog.dll on to the Windows System32 folder.

It also alters the windows registry at the following location to load itself during next startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

It also alters the following registry location:

HKEY_CLASSES_ROOT\CLSID\ {E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32 Default

To propagate itself, the worm scans the following extensions and collects the available email addresses from the infected system;

.asp
.htm
.adb
.tbb
.dbx
.php
.sht
.wab
.pl

The worm does not mail itself to the domains containing the following strings:

no
me
ca
you
not
info
page
bugs
soft
site
your
help
root
ntivi
feste
admin
noone
rating
the.bat
google
anyone
nobody
submit
accoun
certific
contact
nothing
privacy
support
service
icrosoft
listserv
samples
someone
gold-certs
somebody
webmaster
postmaster

This worm first appeared on 03rd September, 2004.

 Other names of W32/Mydoom.T Worm:

This Worm is also known as WORM_MYDOOM.T, W32/Mydoom.t@MM, Mydoom.T, W32/Mydoom.T.worm.