# MA-066.012004: MyCERT Advisory - W32.Novarg.A@mm Worm

**Date:** 29 Jan 2004  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-066.012004  
**Advisory ID:** MA-066.012004

---

1.0 Description
#### 1.1 Overview
MyCERT received information from various anti-virus vendors and CERTs communities around the world regarding the wild spread of a newly discovered worm, the W32.Novarg.A@mm. This mass-mailing worm was first discovered on 26, 2004 1:47 PM (US Pacific Time). The worm was first detected in Malaysia on Tuesday morning, 27th January 2004.
This worm runs a backdoor component, which it drops as the file SHIMGAPI.DLL. It opens port 3127 to 3198 to allow remote users to access and manipulate infected systems. The backdoor also has the ability to download and execute arbitrary files.
It performs a denial-of-service (DoS) attack against the software business site www.sco.com. It attacks the site if the system date is February 1, 2004 or later. It ceases attacking the site and running most of its routines on February 12, 2004.
#### 1.2 Propagation
The worm propagates through email attachments with file extension of .bat, .cmd, .exe, .pif, .scr, or .zip to addresses found in the infected PC's address book.
#### 1.3 Systems Affected
Systems that are vulnerable to this worm are:
> 1.3.1 Windows 2000,
> 1.3.2 Windows 95,
> 1.3.3 Windows 98,
> 1.3.4 Windows Me,
> 1.3.5 Windows NT,
> 1.3.6 Windows Server 2003,
> 1.3.7 Windows XP
#### 1.4 Aliases
W32/Mydoom@mm (McAfee)
WORM\_MIMAIL.R (Trend Micro)
#### 1.5 Payload
1.5.1 Sending out mass worm infected emails to email addresses found in the PC's address book but excludes email addresses ending with .edu domains.
1.5.2 Degrades performances as it launches DOS to www.sco.com.
1.5.3 Allows unauthorized remote access via a backdoor that it creates upon infection on TCP port 3127 to 3198.
### 2.0 Technical Matters
2.1 The file size is 22kb (22 528 bytes). It is .exe file. The attachment is attached as .zip, .bat, .cmd, .exe, .pif, .scr, or .zip. file. The file names for the attachment(it can be one of these):
> document
> readme
> doc
> text
> file
> data
> test
> message
> body
When the worm has the extension of .exe or .scr, the file will use the icon which normally represents a text file:
Otherwise the icon displayed will look like the following:
2.2 The worm will perform a Denial of Service against www.sco.com using a direct connection to port 80 between 1 February 2004 and 12 February 2004. It will create 64 threads which send GET requests. The worm will stop spreading on 12 February 2004.
The worm will request the main page of the website SCO.COM roughly every second (1024 milliseconds) from each of the infected machines throughout the globe. The request is a simple"GET / HTTP/1.1", aimed to overload their webserver.
2.3 Once the machine is infected (the attachment is executed), the 'Message' using notepad which display garbage characters will be launch.
2.4 At the registry,
1. It will add the value 'TaskMon' = %System%\taskmon.exe to the registry key:
> HKEY\_CURRENT\_USER\Software\Microsft\Windows\CurrentVersion\Run\'TaskMon' = %System%\taskmon.exe
or, if it fails:
> HKCU\Software\Microsoft\Windows\CurrentVersion\Run\'TaskMon' = %sysdir%\taskmon.exe
2. It creates the following registry keys:
> HKEY\_LOCAL\_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\Version
> HKEY\_CURRENT\_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\Version
3. It will add shimgapi.dll at registry which is loaded by EXPLORER.EXE:
> HKEY\_CLASSES\_ROOT\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32 "(Default)" = %SysDir%\shimgapi.dll
2.5. The worm will drop itself as 'taskmon.exe' file (with size 22kb) and 'shimgapi.dll' (backdoor) file at system directory and 'Message' in temporary directory. There is legitimate file of taskmon.exe in the %Windir% folder. Ensure to delete the taskmon.exe at %system% folder with size 22kb.
%System% is a variable. By default, the path is:
> C:\Windows\System\
> taskmon.exe for (Windows 95/98/Me),
> shimgapi.dll
>
> C:\Winnt\System32\
> taskmon.exe for (Windows NT/2000), or
> shimgapi.dll
>
> C:\Windows\System32\
> taskmon.exe for (Windows XP).
> shimgapi.dll
2.6. It will search for email addresses in all files with the extensions as below.
- htm
- sht
- php
- asp
- dbx
- tbb
- adb
- pl
- wab
- txt
If the worm found email addresses in these files, it will send email to the email addresses using it owns SMTP engine. It ignores addresses which end in ".edu".
2.7. This worm will create a listening thread in the range of port 3127 to 3198
2.8. The infected email is as below. It can be one of the following for subject, message and attachment.
**From:** may be a spoofed from address
**Subject:**
test
hi
hello
Mail Delivery System
Mail Transaction Failed
Server Report
Status
Error
**Message:**
Mail transaction failed. Partial message is available.
The message contains Unicode characters and has been sent as a binary attachment.
The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.
**Attachment:**
document
readme
doc
text
file
data
test
message
body
**with one of the following suffixes:**
.pif
.scr
.exe
.cmd
.bat
.zip
2.9. Copies itself to KaZaA download directory as one of the following files:
- winamp5
- icq2004-final
- activation\_crack
- strip-girl-2.0bdcom\_patches
- rootkitXP
- office\_crack
- nuke2004
with a file extension of>/P>
- pif
- scr
- bat
- exe
### 3.0 Possible Steps
#### 3.1 Prevention
**3.1.1 ISP Level**
ISPs may want to consider monitoring traffics to www.sco.com and www.microsoft.com begining 1st February 2004 and consider to block access to the above sites if confirmed that the worm REALLY DOES DOS attacks to the sites. Blocking access to the sites should be lifted if confirmed no DOS is detected after that.
**3.1.2 Email Gateway Filtering**
Sites are encouraged to apply filters at email gateways to block any attachments associated to the worm.
**3.1.3 Network Based Scanner**
System Administrator and Network Adminstrators, may consider to install a network based scanner, The Retina MyDoom Scanner, a tool created by eEye that is able to scan up to 256 IP addresses at once to determine if any have been infected by the recent MyDoom email virus or its variants. If an IP address is found to be infected/vulnerable, then the Retina MyDoom Scanner will flag that IP address.
FREE Retina MyDoom Scanner at:
http://www.eeye.com/html/Research/Tools/Download.asp?file=RetinaMyDoom
**3.1.4 System/Host**
Users should make sure that their PCs are installed with anti-virus softwares and are updated continuously with latest signature files. Users who do not have an anti-virus installed in their PCs may download an anti-virus from the following site:
[https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=b83f4c4d-f1e2-4a9d-ab55-6389ae1f6efc](https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=b83f4c4d-f1e2-4a9d-ab55-6389ae1f6efc
)
Organizations are also advised to close unnecessary services and ports except for http port. If other services/ports need to be utilized, then they should be filtered to authorized users only.
**3.1.5 Safe Email Practices**
MyCERT strongly urges users not to open any unknown attachments that they receive via emails. They should delete any suspicious emails or they may forward to the respective ISPs or CERTs for verification.
Users may refer to the following guidelines on safe email practices:
[https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=96fa0022-2ca9-47cb-975f-0d1225cc278e](https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=96fa0022-2ca9-47cb-975f-0d1225cc278e
)
**3.1.6 Disabling Unnecessary Notification Messages from AV Filters**
System Administrators may consider to configure their anti -virus filters at their email gateway not to send notification messages to sender email address in order to minimize spammings caused by spoofed email address.
In addition, System Administrators can also configure their anti-virus at their email gateway not to send notification messages to receiver email address to avoid their mailbox get flooded with the unnecessary messages.
However, since the notification messages to sender and receiver is useful system administrators are reminded to enable them once the peak of the worm activities is reduced.
Users may refer to the following guidelines on configuring anti-virues filter:
Corporate Guideline in Configuring Anti-virus Filters to Disable Sending Virus Notification Messages
http://www.mycert.org.my/other\_resources/antivirus\_filter.pdf
#### 3.2 Detection
You may scan your machine with an updated Anti-virus software to detect the presence of the worm. List of anti-virus vendors ia available at:
[https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=b83f4c4d-f1e2-4a9d-ab55-6389ae1f6efc](https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=b83f4c4d-f1e2-4a9d-ab55-6389ae1f6efc
)
#### 3.3 Removal and Recovery
There are two ways of removal which is using automatic removal tool or manual removal. Below are the recommended procedures:
**3.3.1 Automatic Removal Tool**
3.3.1.1 Disconnect the infected machine from the network
3.3.1.2 Disable system restore (Windows XP/ Windows Me).
3.3.1.3 Update the antivirus signature file
3.3.1 4 Run a full system scan and delete all the files detected as Worm\_Mimial.R worm.
3.3.1.5 You may download a Automatic Removal tool provided by the AV Vendors which detects and removes the worm. Make sure you download the tool from a non-infected PC into a media. Automatic removal tools can be downloaded at:
**Symantec:**
http://securityresponse.symantec.com/avcenter/venc/data/[[email protected]](/cdn-cgi/l/email-protection)
**F-Secure:**
ftp://ftp.f-secure.com/anti-virus/tools/f-mydoom.zip
http://www.f-secure.com/tools/f-mydoom.zip
**The unpacked version is available from:**
ftp://ftp.f-secure.com/anti-virus/tools/f-mydoom.exe
http://www.f-secure.com/tools/f-mydoom.exe
ftp://ftp.f-secure.com/anti-virus/tools/f-mydoom.txt
http://www.f-secure.com/tools/f-mydoom.txt
**Trend Micro:**
http://www.trendmicro.com/download/dcs.asp
After downloading the automatic removal tool, you need to run the tool on the infected PC to detect and clean up the worm.
3.3.1.3 Re-scan the PC with an updated Anti-virus to verify the PC is clean
3.3.1.4 Re-connect the PC back to the network
3.3.1.5 Enable the System Restore (for Windows XP/Windows Me)
**2.3.2 Manual Removal**
3.3.2.1 Disconnect the infected machine from the network
3.3.2.2 Disable System Restore(Windows XP/Windows Me only).
**For Windows XP:**
1. Click Start.
2. Right-click My Computer, and then click Properties.
3. Click the System Restore tab.
4. Select "Turn off System Restore" or "Turn off System Restore on all drives" check box.
**For Windows Me:**
1. Click Start, point to Settings, and then click Control Panel.
2. Double-click the System icon. The System Properties dialog box appears.
3. Click the Performance tab, and then click File System. The File System Properties dialog box appears.
4. Click the Troubleshooting tab, and then check Disable System Restore
5. Click OK. Click Yes, when you are prompted to restart Windows
3.3.2.3 Update the antivirus signature file.
3.3.2.4 Restart the computer in Safe mode or VGA mode.
3.3.2.5 Delete all the dropped file by the worm at registry.
1. Click Start, and then click Run. (The Run dialog box appears.)
2. Type regedit. Then click OK. (The Registry Editor opens.)
3. Navigate to the key:
HKEY\_CURRENT\_USER\Software\Microsoft\Windows\CurrentVersion\Run
4. In the right pane, delete the value:
'TaskMon' = %System%\taskmon.exe
5. Navigate to the key:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
6. In the right pane, delete the value:
'TaskMon' = %sysdir%\taskmon.exe
7. Navigate to the key:
HKEY\_LOCAL\_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\
8. In the right pane, delete the value:
ComDlg32\Version
9. Navigate to the key:
HKEY\_CURRENT\_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\
10. In the right pane, delete the value:
ComDlg32\Version
11. Navigate to the key:
HKEY\_CLASSES\_ROOT\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32
12. In the right pane, delete the value:
(Default)= %SysDir%\shimgapi.dll
13. Exit the Registry Editor and restart the system
3.3.2.6 Delete all the dropped file by the worm from the Windows System Directory
%SysDir%\taskmon.exe
%SysDir%\shimgapi.dll
3.3.2.7 Go to Recycle Bin. Delete and empty the Recycle Bin.
3.3.2.8 Enable the System Restore (for Windows XP/Windows Me)
3.3.2.9 Re-scan the machine with an Anti-virus software to make sure the machine is clean
3.3.2.10 Re-connect the machine to the network
### 4.0 More Information
More information on this worm can be obtained from the following sites:
**4.1 Symantec**
http://securityresponse.symantec.com/avcenter/venc/data/[[email protected]](/cdn-cgi/l/email-protection)
**4.2 Trend Micro**
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM\_MIMAIL.R