Worm

Email-Worm.Win32.Mydoom.l removal tips

Malware Removal

The Email-Worm.Win32.Mydoom.l is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Email-Worm.Win32.Mydoom.l virus can do?

  • A process attempted to delay the analysis task.
  • Attempts to connect to a dead IP:Port (31 unique times)
  • Starts servers listening on 0.0.0.0:1042
  • Reads data out of its own binary image
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Steals private information from local Internet browsers
  • Installs itself for autorun at Windows startup
  • Creates a copy of itself
  • Harvests information related to installed mail clients
  • Makes SMTP requests, possibly sending spam or exfiltrating data.
  • Creates a slightly modified copy of itself

Related domains:

ma1-aaemail-dr-lapp01.apple.com
ma1-aaemail-dr-lapp02.apple.com
ma1-aaemail-dr-lapp03.apple.com
rn-mailsvcp-ppex-lapp14.apple.com
rn-mailsvcp-ppex-lapp15.apple.com
rn-mailsvcp-ppex-lapp24.apple.com
rn-mailsvcp-ppex-lapp34.apple.com
rn-mailsvcp-ppex-lapp35.apple.com
rn-mailsvcp-ppex-lapp44.apple.com
rn-mailsvcp-ppex-lapp45.apple.com
onlineconnections.com.au
mx1-lw-eu.apache.org
apple.com
mx1-lw-us.apache.org
mx2-lw-eu.apache.org
mx2-lw-us.apache.org
openoffice.org
ismtp.sitestar.everyone.net
mx01.oxsus-vadesecure.net
mx.cam.ac.uk
mxa-00377f01.gslb.pphosted.com
pb-mx20.pobox.com
theriver.com
pb-mx21.pobox.com
mx02.oxsus-vadesecure.net
pb-mx10.pobox.com
mx03.oxsus-vadesecure.net
pb-mx23.pobox.com
pb-mx22.pobox.com
mx04.oxsus-vadesecure.net
pb-mx11.pobox.com
pb-mx9.pobox.com
pb-mx14.pobox.com
netcom.com
pobox.com
mx.pobox.com
unicode.org
mail.pobox.com
mx.unicode.org
smtp.pobox.com
mail.unicode.org
smtp.unicode.org
cl.cam.ac.uk
mx.cl.cam.ac.uk
mx.apple.com
mail.cl.cam.ac.uk
mx.onlineconnections.com.au
mail.onlineconnections.com.au
mail.apple.com
mx.theriver.com
smtp.apple.com
mail.theriver.com
mx.netcom.com
mail.netcom.com
smtp.onlineconnections.com.au
smtp.netcom.com
pb-bounce5.pobox.com
mail.ietf.org
pb-bounce4.pobox.com
mx1.freebsd.org
mxg.dd.org
mx66.freebsd.org
park-mx.above.com
bounce2.pobox.com
wellpartner-com.mail.protection.outlook.com
ietf.org
dd.org
freebsd.org
mx.bounce2.pobox.com
mail.bounce2.pobox.com
smtp.bounce2.pobox.com
2mx.integra.net
smtp.cl.cam.ac.uk
mx.dd.org
mx.dom.ain
mx.freebsd.org
wellpartner.com
mx.ietf.org
CMU-MX-04.ANDREW.cmu.edu
zzz.org
mailfilter01.leaseweb.us
CMU-MX-01.ANDREW.cmu.edu
CMU-MX-02.ANDREW.cmu.edu
CMU-MX-03.ANDREW.cmu.edu
mail.dom.ain
mail.freebsd.org
cmu.edu
smtp.freebsd.org
mail.dd.org
mailfilter02.leaseweb.us
smtp.ietf.org
mail.mailroute.net
smtp.dom.ain
smtp.dd.org
babylon.socal-raves.org
shore.net
mx.smtp.ucla.edu
mx.cougar.noc.ucla.edu
mail.cougar.noc.ucla.edu
smtp.cougar.noc.ucla.edu
mx2.mailchannels.net
in2-smtp.messagingengine.com
ucla.edu
mx1.mailchannels.net
in1-smtp.messagingengine.com
socal-raves.org
cravindogs.com
mail.python.org
python.org
mx.wellpartner.com
mail.wellpartner.com
mx.nemga8.fc
aspmx3.googlemail.com
acm.org
mx.python.org
mail.nemga8.fc
smtp.nemga8.fc
smtp.wellpartner.com
mx.zzz.org
mx1.surfmailfilter.nl
aspmx2.googlemail.com
mx2.surfmailfilter.nl
cwi.nl
mx01.lightboundhosting.com
oxy.edu
smtp.python.org
mx.shore.net
hamlmail.niwa.co.nz
mail.shore.net
iquest.net
mx.ucla.edu
mail.ucla.edu
mx.socal-raves.org
mail.socal-raves.org
cryptsoft.com
smtp.socal-raves.org
mx.cryptsoft.com
mail.cryptsoft.com
mx.acm.org
mail.acm.org
smtp.acm.org
mail.zzz.org
mx.cwi.nl
mx.oxy.edu
mxa-0066c301.gslb.pphosted.com
mxb-0066c301.gslb.pphosted.com
ratp.fr
mx13.blackberry.com
mail.cwi.nl
mail.oxy.edu
smtp.cwi.nl
mx.iquest.net
mail.iquest.net
smtp.ucla.edu
mta.openssl.org
openssl.org
mxa-00069f01.gslb.pphosted.com
mxb-00069f01.gslb.pphosted.com
oracle.com
smtp.cryptsoft.com
mx1.mail.ovh.net
mx.oracle.com

How to determine Email-Worm.Win32.Mydoom.l?


File Info:

crc32: 4EDC7A12
md5: 60599f51770b216d42a2c435f33718d8
name: 60599F51770B216D42A2C435F33718D8.mlw
sha1: fc2073bfd6d7c8be5b30f0196110056b3ed2b109
sha256: 014f8b3c7eccfd07a7f917982112dde6964f6d2cef2200e0f20519adb3c7ac45
sha512: 4c94f6ac9e1de39844258bb8a7e7d0ae068b1cf01cd7176c81b3b0747e11a60a2ab3aa4646dc416cfdc9df69ad51306060713f652dafba448cdc6b283b40cb9c
ssdeep: 768:SCIqdH/k1ZVcT194jp4l5u5Gm88sRz6ry4qOGdx8rIe/GYHX5J:SNqaLV8a6l5uMm8NmyPo
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:

0: [No Data]

Email-Worm.Win32.Mydoom.l also known as:

BkavW32.MyDoomLB.Worm
K7AntiVirusEmailWorm ( 0000439f1 )
Elasticmalicious (high confidence)
DrWebWin32.HLLM.MyDoom.61471
CynetMalicious (score: 100)
CAT-QuickHealWorm.Mydoom
ALYacWorm.Mydoom
CylanceUnsafe
ZillyaWorm.Mydoom.Win32.3
SangforSuspicious.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (W)
K7GWEmailWorm ( 0000439f1 )
Cybereasonmalicious.1770b2
BaiduWin32.Worm-Email.Mydoom.a
CyrenW32/Mydoom.CJDZ-5239
ESET-NOD32Win32/Mydoom.Q
ZonerWorm.Win32.Mydoom.24203
APEXMalicious
AvastWin32:Mydoom-EG [Trj]
ClamAVWin.Worm.Mydoom-5
KasperskyEmail-Worm.Win32.Mydoom.l
BitDefenderWin32.Worm.MyDoom.NF
NANO-AntivirusTrojan.Win32.Mydoom.cuyllc
ViRobotI-Worm.Win32.Mydoom.35784
MicroWorld-eScanWin32.Worm.MyDoom.NF
TencentWorm.Win32.Mydoom.l
Ad-AwareWin32.Worm.MyDoom.NF
SophosMal/Generic-R + W32/MyDoom-N
ComodoWorm.Win32.Mydoom.Q@308v
BitDefenderThetaAI:Packer.DFC754A81F
VIPREEmail-Worm.Win32.Mydoom.gen (v)
TrendMicroWORM_MYDOOM.GEN
McAfee-GW-EditionBehavesLike.Win32.Mydoom.pc
FireEyeGeneric.mg.60599f51770b216d
SentinelOneStatic AI – Malicious PE
JiangminI-Worm/Zhelatin.sq
AviraTR/BAS.Samca.zictf
eGambitUnsafe.AI_Score_99%
Antiy-AVLTrojan/Generic.ASMalwS.1BED5
KingsoftWin32.Troj.Generic_a.c.(kcloud)
MicrosoftWorm:Win32/Mydoom.L@mm
GridinsoftWorm.Win32.Mydoom.ka!i
ArcabitWin32.Worm.MyDoom.NF
SUPERAntiSpywareWorm.MyDoom
ZoneAlarmEmail-Worm.Win32.Mydoom.l
GDataWin32.Worm.MyDoom.NF
AhnLab-V3Win32/Mydoom.worm.22020.H
Acronissuspicious
McAfeeGenericRXLN-WS!60599F51770B
MAXmalware (ai score=82)
VBA32Backdoor.Shiz
MalwarebytesMydoom.Worm.DDoS.DDS
PandaW32/Mydoom.DN.worm
TrendMicro-HouseCallWORM_MYDOOM.GEN
RisingWorm.Mail.Win32.Mydoom.l (CLASSIC)
IkarusEmail-Worm.Win32.Mydoom
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/MyDoom.M@mm
AVGWin32:Mydoom-EG [Trj]

How to remove Email-Worm.Win32.Mydoom.l?

Email-Worm.Win32.Mydoom.l removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment