W32.Mydoom

Overview

W32.Mydoom, also called W32.Novarg.A@mm, W32/Mydoom@MM, WORM_MIMAIL.R, Mydoom, is a mass-mailing worm, sending messages with the following subjects: Status, test, Test, TEST, hello, HELLO, Server Report, hi, HI, Error.

The email contains an attachment named: message.exe, body.zip, ogp.zip, document.zip, text.zip, message.zip, ymplf.zip, readme.zip, file.zip, body.zip, text.pif, document.pif, doc.pif, data.zip, doc.zip, raun.zip, etwblf.zip, etc.

A clear sign of infections is the existence of %SystemDir%\shimgapi.dll or %SystemDir%\taskmon.exe.

Note: %SystemDir% is a variable (?). By default, this is C:\Windows\System (Windows 95/98/Me), C:\WINNT\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Note that %WinDir%\taskmon.exe is a legitimate file in the Windows 95/98/Me operating systems. Do not delete %WinDir%\taskmon.exe.
Note: %WinDir% is a variable (?). By default, this is C:\Windows (Windows 95/98/Me/XP) or C:\WINNT (Windows NT/2000).

Classification

Worm

Files

shimgapi.dll, taskmon.exe

If you have any of the files related to W32.Mydoom on your system, please send them for additional analysis. Generally, I have only analysed a few versions for each software component listed at this web site. With your help I will be able to look at both old and more recent versions of the W32.Mydoom software. Thank you very much for your time!

Detection

Bazooka Adware and Spyware Scanner detects W32.Mydoom. Bazooka is freeware and detects spyware, adware, foistware, trojan horses, viruses, worms and other potentially unwanted applications. Read more »

Uninstall procedure

Please go to the anti-virus recommendation page. You can find both free products or use one of the trials to remove the virus.

Manual removal

Please follow the instructions below if you would like to remove W32.Mydoom manually. Please notice that you must follow the instructions very carefully and delete everything that is mentioned. In most cases the removal will fail if one single item is not deleted. If W32.Mydoom remains on your system after stepping through the removal instructions, please double-check by stepping through them again.

1. Start your computer in safe mode.
2. Start the registry editor. This is done by clicking Start then Run. (The Run dialog will appear.) Type regedit and click OK. (The registry editor will open.)
3. Browse to the key:
   'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run'
4. In the right pane, delete the value called 'TaskMon', if it exists.
5. Browse to the key:
   'HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run'
6. In the right pane, delete the value called 'TaskMon', if it exists.
7. Exit the registry editor.
8. Start Windows Explorer and delete:
   %SystemDir%\shimgapi.dll
   %SystemDir%\taskmon.exe
   Note: %SystemDir% is a variable (?). By default, this is C:\Windows\System (Windows 95/98/Me), C:\WINNT\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Problems uninstalling? Click here.

I'm looking for your help!

Thank you for using my site, I hope you find it useful. I'm looking for help from all users, please read more.

Contact information for W32.Mydoom's vendor

In order to provide correct, accurate and updated information about W32.Mydoom I encourage the vendor to contact me if any part of this write-up needs a revision.