Signature Detail

TROJAN: MyDoom Backdoor Communication

This signature detects the MyDoom backdoor Trojan. MyDoom set up on several TCP ports (80,3127-3130). Upon receiving a specially formatted packed, MyDoom automatically executes whatever code it receives through its listening port. Users that are running SOCKS proxies on TCP port 1080 should be aware that MyDoom can send packets on this port and should consider editing the attack object to reduce false positives.

Extended Description

MyDoom is a worm that infects vulnerable Windows operating systems. It propagates through e-mail using its own Simple Mail Transfer Protocol (SMTP) engine.

References

• CVE: CVE-1999-0660
• URL: http://www.f-secure.com/v-descs/novarg.shtml
• URL: http://securityresponse.symantec.com/avcenter/venc/data/w32.mydoom.m@mm.html
• URL: http://us.mcafee.com/virusInfo/default.asp?id=mydoom