TrendLabs Malware Blog
Glossary
TrendWatch
TrendLabs Twitter
WORM_MYDOOM.EA
Overview

Malware type: Worm

Aliases: No Alias Found

In the wild: Yes

Destructive: No

Language: English

Platform: Windows 98, ME, NT, 2000, XP, Server 2003

Encrypted: No

Overall risk rating:


Reported infections:

Damage potential:

High

Distribution potential:

High

Infection Channel 1 : Propagates via email


Description: 

This worm has received attention from independent media sources and/or other security firms.

To get a one-glance comprehensive view of the behavior of this malware, refer to the Threat Diagram shown below.

WORM_MYDOOM.EA Behavior Diagram

Malware Overview

This worm arrives as an attachment to mass-mailed email messages. It may also be dropped by other malware or downloaded unknowingly by a user when visiting malicious Web sites.

When executed, it starts certain services on the affected system.

It also checks and deletes files related to network analysis tools/software, rendering these unusable.

This worm is capable of conducting denial of service (DoS) attacks on certain websites. It also terminates certain services if found on the system.

It downloads a malware detected by Trend Micro as TROJ_JPEGDRPR.B. The said malware in turn drops an MBR infector malware detected as WORM_MYDOOM.EB. Thus, malicious routines of WORM_MYDOOM.EB are also exhibited on the affected system.

It then deletes itself after execution.

For additional information about this threat, see:
Solution
Technical Details

Description created: Jul. 10, 2009 5:26:53 AM GMT -0800

Search a new malware

Tell us how we did. Take our quick survey.