the MyDoom.B Worm?
|The MyDoom.B is a variation of the
original MyDoom.A worm released on January 26, 2004. It
spoofs the FROM address of its messages so that they appear to be sent
from another email address rather than the actual infected machine and
user. It also travels via the Kazaa peer-to-peer file sharing network.
The mass mailing worm arrives as an attachment with a file extension of
.bat, .cmd, .exe, .pif, .scr, or .zip.
worm performs a denial of service attack against www.sco.com. It will
begin this attack if the system date is February 1, 2004 and has a
built-in expiration date of March 1, 2004 when it will stop running
most of its routines. When the system date is February 3,
2004 it begins a DoS attack against www.microsoft.com
earlier variant, this worm also has a backdoor component.
runs a backdoor component, which it drops as the file CTFMON.DLL. This
trojan component allows remote users to access and manipulate infected
systems. The backdoor routine has the ability to download and execute
It runs on
Windows 98, ME, NT, 2000 and XP.
From: <Spoofed email address>
(any of the following)
to deliver the message
Body: (any of the following)
message contains Unicode characters and has been sent as a binary
message cannot be represented in 7-bit ASCII encoding and has been sent
as a binary attachment.
transaction failed. Partial message is available.
#804 occured during SMTP session. Partial message has been received.
message contains MIME-encoded graphics and has been sent as a binary
daemon reported:Error #804 occured during SMTP session. Partial message
has been received.
one of the following suffixes:
Does MyDoom.B Worm Infect My System?
worm is activated, it performs the following tasks:
the following files:
file ctfmon.dll acts as a proxy server that can potentially
allow a hacker to connect to the machine via and utilize it as a proxy
to gain access to it's network resources. In addition, the backdoor has
the ability to download and execute arbitrary files.
is loaded by EXPLORER.EXE via the registry key:
(Default) = %System%\ctfmon.dll
- Adds the
Explorer = %System%\explorer.exe
to the registry keys
on February 1, 2004 it can perform a Denial of Service against
www.sco.com. On February 3, 2004 it also starts a DoS attack on
www.microsoft.com . The DoS attack will continue until March 1, 2004.
also overwrites the HOSTS file to prevent the infected users from
accessing the following sites:
if the system date is greater than or equal to February 3, 2004, it
does not add the line “0.0.0.0 www.microsoft.com”
to the HOSTS file so that it may perform its DoS attack on this
the following registry keys:
the Windows Address book (including in the Temporary Internet Files
folder) for email addresses and domain names.
to send emails by using its own SMTP engine.
virus checks all running process in the infected system and searches
for the presence of its mother variant, WORM_MYDOOM.A. It
terminates all processes that runs the module SHIMGAPI.DLL or if the
process name is TASKMON.EXE.
- Then, it
drops a copy of itself in the Kazaa shared folder with a file name that
starts from any of the following:
Can I Remove the MyDoom.B virus?
these steps in removing the MyDoom.B worm.
1) Restart your Computer in
Safe mode by pressing F8 as the computer is booting. The
backdoor component attaches itself to the Explorer.exe file, so
restarting in Safe mode should allow you to remove it the easiest.
the Registry entries
(deleting the wrong item
in the registry can render your computer unbootable, do not follow
these steps unless you have made a backup of the registry or can
recover from a corrupted registry)
- Click on
Start, Run, Regedit
- In the
left panel go to the following keys
- In the
right panel, right-click and delete the following entry
"Explorer = %System%\explorer.exe"
- In the
left panel go to the following keys and delete them
- In the left panel go to the following key
- In the
right pane, modify the value as follows, depending on your operating
the infected files (for Windows ME and
XP you may have to disable
system restore to remove infected backed up files as well)
the computer and run a thorough virus scan using your favorite
antivirus program or online scan at
For More Information on this original MyDoom virus click here
Tools for Removing Spyware, Adware, and Malware
Spyware/Adware Removal Help
MSBlast.exe Worm Removal
Welchia (Dllhost.exe and SVCHost.exe) Worm Removal
Uninstall McAfee Instructions
Uninstall Norton Instructions
Uninstall Avast Instructions
Uninstall AVG Instructions
Uninstall Antivir Instructions
Uninstall Panda Instructions
How to Manually Run the Microsoft Malicious Software Removal Tool
Bloodhound.Exploit.6 Virus Removal
MyDoom Virus Removal
MiMail.C Virus Removal
Swen Worm Virus Removal
SoBig.F Worm Removal
Dumaru Virus Removal
BugBear.B Worm Removal
SoBig.E Worm Removal
Pop Up Ad Removal Info
KAK Worm Removal
MiMail.A Worm Removal
W95.MTX Virus Removal
Snow White Virus Removal
BadTrans Trojan Removal
Wininit Virus (Bymer Trojan)
Happy99 Worm Removal
VBS Netlog Worm Removal
Pretty Park Worm Removal
Sasser Worm Virus Removal
Backdoor SDBot.H Trojan Removal
Computer Security Information
Back Orifice Information
PC HELL Main Page
iPadastic - News, Tutorials, Help, Tips, and Hints for the iPad
Download Hoyle Games
including Casino 3D, Card, Board, and Solitaire games.