TROJAN: MyDoom Backdoor Communication

This signature detects the MyDoom backdoor Trojan. MyDoom set up on several TCP ports (80,3127-3130). Upon receiving a specially formatted packed, MyDoom automatically executes whatever code it receives through its listening port. Users that are running SOCKS proxies on TCP port 1080 should be aware that MyDoom can send packets on this port and should consider editing the attack object to reduce false positives.

Extended Description

MyDoom is a worm that infects vulnerable Windows operating systems. It propagates through e-mail using its own Simple Mail Transfer Protocol (SMTP) engine.

References

CVE: CVE-1999-0660

URL: http://www.f-secure.com/v-descs/novarg.shtml http://securityresponse.symantec.com/avcenter/venc/data/w32.mydoom.m@mm.html http://us.mcafee.com/virusInfo/default.asp?id=mydoom

Short Name

TROJAN:MYDOOM:MYDOOM-TROJAN

Severity

Major

Recommended

False

Recommended Action

None

TROJAN: MyDoom Backdoor Communication

Extended Description

References

Found a potential security threat?