Google search is down - dslreports.com

Author

All Replies

Greg_Z
Premium
join:2001-08-08
Springfield, IL

Google search is down

Being discussed over in the General Questions forum. Possible issue with MyDoom causing problems with Google.com not being able to resolve host names.

© 1995-2004 Symantec Corporation.
All rights reserved.
Legal Notices
Privacy Policy

W32.Mydoom.M@mm
Discovered on: July 26, 2004
Last Updated on: July 26, 2004 04:10:53 PM

W32.Mydoom.M@mmis a mass-mailing worm that opens a backdoor and uses its own SMTP engine to spread through email.

The worm is packed using UPX.

Type: Worm

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP
Systems Not Affected: DOS, Linux, Macintosh, Novell Netware, OS/2, UNIX

Virus Definitions (Intelligent Updater) *
July 26, 2004

Virus Definitions (LiveUpdate™) **
July 26, 2004

*
Intelligent Updater definitions are released daily, but require manual download and installation.
Click here to download manually.

**
LiveUpdate virus definitions are usually released every Wednesday.
Click here for instructions on using LiveUpdate.

Wild

Number of infections: 0 - 49
Number of sites: 0 - 2
Geographical distribution: Low
Threat containment: Easy
Removal: Easy
Threat Metrics

Wild:
Medium
Damage:
Medium
Distribution:
High

Damage

Payload Trigger: n/a
Payload: n/a
Large scale e-mailing: Yes
Deletes files: n/a
Modifies files: n/a
Degrades performance: n/a
Causes system instability: n/a
Releases confidential info: n/a
Compromises security settings: n/a
Distribution

Subject of email: Varies
Name of attachment: Varies
Size of attachment: n/a
Time stamp of attachment: n/a
Ports: n/a
Shared drives: n/a
Target of infection: n/a

When W32.Mydoom.M@mm is executed, it performs the following actions:

Copies itself as:

%Windir%\java.exe
%Windir%\services.exe

Note: %Windir% is a variable. The worm locates the Windows installation folder (by default, this is C:\Windows or C:\Winnt) and copies itself to that location.

Adds the values:

"Services" = "%Windir%\services.exe"
"JavaVM" = "%Windir%\java.exe"

to the registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

so that it will load when Windows starts.

May create the following files for logging purposes:

%Temp%\zincite.log
%Temp%\[randomly named file].log

Attempts to copy itself to all folders whose names contain the following strings:

USERPROFILE
yahoo.com

Gathers email addresses from files with the following extensions:

.doc
.txt
.htm
.html

When the worm finds an open Outlook window, it will attempt to send itself to email addresses it found.

The email has the following characteristics:

From:
The From address will be spoofed.

Subject: (One of the following)

say helo to my litl friend
click me baby, one more time
hello
error
status
test
report
delivery failed
Message could not be delivered
Mail System Error - Returned Mail
Delivery reports about your e-mail
Returned mail: see transcript for details
Returned mail: Data format error

Body:
The message body will be as follows, where one of each phrase/word in brackets will appear:

Dear user {[To address of mail]|of [domain of To address]},{ {{M|m}ail {system|server} administrator|administration} of [domain of To address] would like to {inform you{ that{:|,}|}|let you know {that|the following}{.|:|,}}|||||}
{We have {detected|found|received reports} that y|Y}our {e{-|}mail |}account {has been|was} used to send a {large|huge} amount of {{unsolicited{ commercial|}|junk} e{-|}mail|spam}{ messages|} during {this|the {last|recent}} week.
{We suspect that|Probably,|Most likely|Obviously,} your computer {had been|was} {compromised|infected{ by a recent v{iru}s|}} and now {run|contain}s a {trojan{ed|}|hidden} proxy server.
{Please|We recommend {that you|you to}} follow {our |the |}instruction{s|} {in the {attachment|attached {text |}file} |}in order to keep your computer safe.
{{Virtually|Sincerely} yours|Best {wishe|regard}s|Have a nice day},
{[domain of To address] {user |technical |}support team.|The [domain of To address] {support |}team.}

{The|This|Your} message was{ undeliverable| not delivered} due to the following reason{(s)|}:
Your message {was not|could not be} delivered because the destination {computer|server} was
{not |un}reachable within the allowed queue period. The amount of time
a message is queued before it is returned depends on local configura-
tion parameters.
Most likely there is a network problem that prevented delivery, but
it is also possible that the computer is turned off, or does not
have a mail system running right now.

Your message {was not|could not be} delivered within [random number] days:
{{{Mail s|S}erver}|Host} [host used to send mail] is not responding.
The following recipients {did|could} not receive this message:

Please reply to postmaster@{[domain of From address]|[domain of To address]}
if you feel this message to be in error.
The original message was received at [current time]{
| }from {[domain of From address] [[host used to send mail]]|{[host used to send mail]|[[host used to send mail]]}}
----- The following addresses had permanent fatal errors -----
{|[To address of mail]}
{----- Transcript of {the ||}session follows -----
... while talking to {host |{mail |}server ||||}{[domain of To address].|[host used to send mail]}:
{>>> MAIL F{rom|ROM}:[From address of mail]
... {Mail quota exceeded|Message is too large}
554 ... Service unavailable|550 5.1.2 ... Host unknown (Name server: host not found)|554 {5.0.0 |}Service unavailable; [[host used to send mail]] blocked using {relays.osirusoft.com|bl.spamcop.net}{, reason: Blocked|}
Session aborted{, reason: lost connection|}|>>> RCPT To:
... {User unknown|Invalid recipient|Not known here}}|>>> DATA
{ Run.
Type regedit

Then click OK.

Navigate to the key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

In the right pane, delete the value:

"Services" = "%Windir%\services.exe"
"JavaVM" = "%Windir%\java.exe"

Exit the Registry Editor.

Restart the computer in Normal mode. For instructions, read the section on returning to Normal mode in the document, "How to start the computer in Safe Mode."

Write-up by: John Canavan
--
One man's customer loyalty is another man's miguided arrogance.


Thursday, 26-Nov 11:02:22	Terms of Use \| Privacy Policy \| Hosting by www.nac.net - DSL,Hosting & Co-lo \| feedback \| contact over 10 years online! © 1999-2009 dslreports.com.republican-creole page compression OFF