W32.Mydoom.B@mm

Risk Level 1: Very Low

Printer Friendly Page|Rate this page

Discovered:: January 28, 2004
Updated:: January 29, 2004 9:04:11 PM
Type:: Worm
Infection Length:: 29184 and 6144 bytes
Systems Affected:: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP

W32.Mydoom.B@mm is an encrypted mass-mailing worm that arrives as an attachment with either a .exe, .scr, .cmd, .zip, or .pif extension. It also performs a denial of service attack on www.microsoft.com and allows unauthorized remote access to the compromised host.

Antivirus Protection Dates

Initial Rapid Release version January 28, 2004
Latest Rapid Release version November 17, 2011 revision 017
Initial Daily Certified version January 28, 2004
Latest Daily Certified version November 17, 2011 revision 018
Initial Weekly Certified release date January 28, 2004

Click for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

Wild Level: Low
Number of Infections: 0 - 49
Number of Sites: 0 - 2
Geographical Distribution: Low
Threat Containment: Easy
Removal: Easy

Damage

Damage Level: Medium
Payload: Attempt to perform a DoS attack on various web sites.
Large Scale E-mailing: Sends a mass mailing of itself.
Modifies Files: Modifies the hosts file to prevent access to certain Web sites.

Distribution

Distribution Level: High
Subject of Email: Varies
Name of Attachment: Varies
Shared Drives: Copies itself to Kazaa download folder.

Writeup By: Scott Gettis

Technical Details

Search Threats

Search by name

Example: W32.Beagle.AG@mm

Internet Security Threat Report, Volume 16