Aliases

Net-Worm.Win32.Mytob.c (Kaspersky Lab) is also known as: W32/Mydoom.gen@MM (McAfee),   W32.Mytob.C@mm (Symantec),   Win32.HLLM.MyDoom.20 (Doctor Web),   W32/Mytob-C (Sophos),   WORM_MYDOOM.GEN (Trend Micro),   Worm/Zusha.A (H+BEDV),   W32/Mytob.D@mm (FRISK),   I-Worm/Mydoom (Grisoft),   Win32.Worm.Mytob.C (SOFTWIN),   Worm.Mytob.A (ClamAV),   W32/Mytob.C.worm (Panda),   Win32/Mytob.D (Eset)

Detection added	Mar 02 2005
Description added	Apr 13 2005
Behavior	Net-Worm

Technical details

This network worm infects computers running Windows. It propagates via the LSASS vulnerability, details of which can be found MS04-011here.

The worm also propagates via the Internet as an attachment to infected emails. It sends itself to all email addresses harvested from the victim machine.

In terms of functionality, this version is almost identical to Mytob.a, differing from it only in the following ways:

1. Mytob.c is approximately 49KB in size, packed using UPX. The unpacked file is approximately 98KB in size.
2. Instead of creating a file named %System%\msnmsgr.exe, Mytob.c creates a file named %System%\wfdmgr.exe
3. It registers this file in the system registry:
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
   [HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices]
   [HKCU\SYSTEM\CurrentControlSet\Control\Lsa]
   [HKCU\Software\Microsoft\OLE]
    "LSA"="wfdmgr.exe"