• Comments (0)
• Report
• Tell a Friend
• Print
• Screenshots

W32.Mydoom.N@mm is a variant of W32.Mydoom.M@mm. It is a mass-mailing worm that drops and executes a backdoor that is detected as Backdoor.Zincite.A, which listens on TCP port 1034.

The worm uses its own SMTP engine to send itself to email addresses that it finds on the infected computer. The email contains a spoofed From address. The subject and body text will vary, as will the name of the attachment.

Symantec Security Response has developed a removal tool to clean the following infections:

· W32.Mydoom.A@mm
· W32.Mydoom.B@mm
· W32.Mydoom.F@mm
· W32.Mydoom.G@mm
· W32.Mydoom.H@mm
· W32.Mydoom.L@mm
· W32.Mydoom.M@mm
· W32.Mydoom.Q@mm
· W32.Mydoom.AM@mm
· W32.Mydoom.AX@mm
· W32.Mydoom.AZ@mm
· W32.Mydoom.BA@mm
· W32.Mydoom.BN@mm
· W32.Mydoom.BO@mm
· W32.Mydoom.BQ@mm
· W32.Mydoom.BT@mm
· W32.Mydoom.BU@mm
· Backdoor.Zincite.A
· W32.Zindos.A
· Backdoor.Nemog
· Backdoor.Nemog.D

The W32.Mydoom@mm Removal Tool does the following :

· Terminates W32.Mydoom@mm, Backdoor.Zincite.A, W32.Zindos.A, Backdoor.Nemog, and Backdoor.Nemog.D viral processes.
· Terminates the viral thread running under Explorer.exe.
· Deletes W32.Mydoom@mm, Backdoor.Zincite.A, W32.Zindos.A, Backdoor.Nemog, and Backdoor.Nemog.D files.
· Reverses the changes made to the registry by all aforementioned threats.
· Repairs the Hosts file, if the computer infected with Backdoor.Nemog and Backdoor.Nemog.D.

What's New in Symantec W32.Mydoom@mm Removal Tool 1.11.0 :

· Version 1.12 released to support W32.Mydoom.BU@mm.