Skip to content

Malware

MyDoom

aka Novarg · Mimail

When executed, the worm opens up Windows' Notepad with garbage data in it.

MyDoom, also known as Novarg, Mimail, is a Windows malware family.

Background

On launch, the worm pops up Windows' Notepad filled with junk data. The malicious emails that propagate copies of the worm vary their subject lines, message bodies, and attachment names.

Most strings inside its UPX-packed body are obscured with ROT13, where each character is shifted 13 positions forward in the alphabet, wrapping back to the start once it passes the final letter.

Mydoom additionally launches a Distributed Denial-of-Service attack against www.sco.com, beginning on February 1st.

It also establishes a backdoor on compromised hosts by dropping a new SHIMGAPI.DLL into the system32 directory and running it as a child process of EXPLORER.EXE.

The worm is set to cease propagating on February 12th.


Source: Malpedia (Fraunhofer FKIE).