Worm

How to remove “Win32.Worm.MyDoom.NF (B)”?

Malware Removal

The Win32.Worm.MyDoom.NF (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Win32.Worm.MyDoom.NF (B) virus can do?

  • A process attempted to delay the analysis task.
  • Attempts to connect to a dead IP:Port (30 unique times)
  • Starts servers listening on 0.0.0.0:1042
  • Reads data out of its own binary image
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Steals private information from local Internet browsers
  • Installs itself for autorun at Windows startup
  • Creates a copy of itself
  • Harvests information related to installed mail clients
  • Makes SMTP requests, possibly sending spam or exfiltrating data.
  • Creates a slightly modified copy of itself

Related domains:

z.whorecord.xyz
a.tomx.xyz
ma1-aaemail-dr-lapp01.apple.com
ma1-aaemail-dr-lapp02.apple.com
ma1-aaemail-dr-lapp03.apple.com
rn-mailsvcp-ppex-lapp14.apple.com
rn-mailsvcp-ppex-lapp15.apple.com
ismtp.sitestar.everyone.net
mx1-lw-eu.apache.org
mx1-lw-us.apache.org
onlineconnections.com.au
mx2-lw-eu.apache.org
rn-mailsvcp-ppex-lapp24.apple.com
mx2-lw-us.apache.org
openoffice.org
mx.cam.ac.uk
pb-mx21.pobox.com
mxa-00377f01.gslb.pphosted.com
mx01.oxsus-vadesecure.net
rn-mailsvcp-ppex-lapp34.apple.com
theriver.com
rn-mailsvcp-ppex-lapp35.apple.com
mx.openoffice.org
rn-mailsvcp-ppex-lapp44.apple.com
mx02.oxsus-vadesecure.net
rn-mailsvcp-ppex-lapp45.apple.com
apple.com
mail.openoffice.org
mx03.oxsus-vadesecure.net
smtp.openoffice.org
mx04.oxsus-vadesecure.net
pb-mx22.pobox.com
netcom.com
pb-mx11.pobox.com
pb-mx20.pobox.com
unicode.org
mx.unicode.org
pb-mx14.pobox.com
mail.unicode.org
smtp.unicode.org
cl.cam.ac.uk
pb-mx9.pobox.com
mx.cl.cam.ac.uk
pb-mx10.pobox.com
mail.cl.cam.ac.uk
pb-mx23.pobox.com
mx.theriver.com
mx.onlineconnections.com.au
mail.onlineconnections.com.au
mx.apple.com
mail.theriver.com
pobox.com
smtp.theriver.com
mail.apple.com
mx.pobox.com
mx.netcom.com
smtp.apple.com
mail.pobox.com
mail.netcom.com
smtp.netcom.com
smtp.onlineconnections.com.au
mail.ietf.org
pb-bounce5.pobox.com
mx1.freebsd.org
park-mx.above.com
pb-bounce4.pobox.com
wellpartner-com.mail.protection.outlook.com
mailfilter02.leaseweb.us
CMU-MX-04.ANDREW.cmu.edu
bounce2.pobox.com
2mx.integra.net
mxg.dd.org
CMU-MX-01.ANDREW.cmu.edu
mx.bounce2.pobox.com
mail.bounce2.pobox.com
smtp.bounce2.pobox.com
CMU-MX-02.ANDREW.cmu.edu
mail.mailroute.net
wellpartner.com
zzz.org
CMU-MX-03.ANDREW.cmu.edu
dd.org
cmu.edu
mailfilter01.leaseweb.us
ietf.org
mx.smtp.ucla.edu
mx.dd.org
mx.ietf.org
mx66.freebsd.org
shore.net
freebsd.org
mx.freebsd.org
mail.dd.org
ucla.edu
smtp.ietf.org
smtp.dd.org
mail.freebsd.org
smtp.freebsd.org
mail.python.org
acm.org
mx1.surfmailfilter.nl
mx01.lightboundhosting.com
hamlmail.niwa.co.nz
mx2.surfmailfilter.nl
cwi.nl
mx.wellpartner.com
mail.wellpartner.com
python.org
iquest.net
oxy.edu
mxb-0066c301.gslb.pphosted.com
smtp.wellpartner.com
mx.zzz.org
mxa-0066c301.gslb.pphosted.com
ratp.fr
mx13.blackberry.com
mx.shore.net
mx.python.org
mail.shore.net
mx.ucla.edu
mail.ucla.edu
aspmx3.googlemail.com
mx.acm.org
mx.cwi.nl
mail.acm.org
aspmx2.googlemail.com
mail.cwi.nl
smtp.acm.org
smtp.cwi.nl
mx.iquest.net
mx.oxy.edu
mail.zzz.org
mail.iquest.net
mx.ratp.fr
mail.oxy.edu
cryptsoft.com
mail.ratp.fr
mx.cryptsoft.com
mail.cryptsoft.com
smtp.ratp.fr
smtp.shore.net
mta.openssl.org
smtp.iquest.net
smtp.ucla.edu
mxb-00069f01.gslb.pphosted.com
mxa-00069f01.gslb.pphosted.com
oracle.com
mx1.mail.ovh.net
openssl.org
mx2.mailchannels.net

How to determine Win32.Worm.MyDoom.NF (B)?


File Info:

crc32: 3A31D15C
md5: f0a4e1b9f16bedb637748b0ae2d38b0b
name: F0A4E1B9F16BEDB637748B0AE2D38B0B.mlw
sha1: 36a61581ee833366a2f75c900cba601a3b317105
sha256: 0ead89a60b4d19bfca4a7d25391acf27e21a2e921eeb45327e1e23737f89a806
sha512: 3754150ab510d9bf8b4f1cb98edd16616af5e0bcb777c821368573b53e2a76590568a0d9812ea4e4ccf0171e912ede3240d00b35c437b8f0696585276a3472d0
ssdeep: 768:SCIqdH/k1ZVcT194jp4yEP5w+814Rz6C3+SOGw8crAmvGFpUqMt:SNqaLV8a6yEPe+8KX3JM
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:

0: [No Data]

Win32.Worm.MyDoom.NF (B) also known as:

BkavW32.MyDoomLB.Worm
K7AntiVirusEmailWorm ( 0000439f1 )
Elasticmalicious (high confidence)
DrWebWin32.HLLM.MyDoom.61471
CynetMalicious (score: 100)
CAT-QuickHealWorm.Mydoom
ALYacWorm.Mydoom
CylanceUnsafe
ZillyaWorm.Mydoom.Win32.3
SangforSuspicious.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (D)
K7GWEmailWorm ( 0000439f1 )
Cybereasonmalicious.9f16be
BaiduWin32.Worm-Email.Mydoom.a
CyrenW32/Mydoom.CJDZ-5239
ESET-NOD32Win32/Mydoom.Q
ZonerWorm.Win32.Mydoom.24203
APEXMalicious
AvastWin32:Mydoom-EG [Trj]
ClamAVWin.Worm.Mydoom-5
KasperskyEmail-Worm.Win32.Mydoom.l
BitDefenderWin32.Worm.MyDoom.NF
NANO-AntivirusTrojan.Win32.Mydoom.cuyllc
ViRobotI-Worm.Win32.Mydoom.35784
MicroWorld-eScanWin32.Worm.MyDoom.NF
TencentWorm.Win32.Mydoom.l
Ad-AwareWin32.Worm.MyDoom.NF
SophosMal/Generic-R + W32/MyDoom-N
ComodoWorm.Win32.Mydoom.Q@308v
BitDefenderThetaAI:Packer.DFC754A81F
VIPREEmail-Worm.Win32.Mydoom.gen (v)
TrendMicroWORM_MYDOOM.GEN
McAfee-GW-EditionBehavesLike.Win32.Mydoom.pc
FireEyeGeneric.mg.f0a4e1b9f16bedb6
EmsisoftWin32.Worm.MyDoom.NF (B)
SentinelOneStatic AI – Malicious PE
JiangminI-Worm/Zhelatin.sq
AviraTR/BAS.Samca.zictf
eGambitUnsafe.AI_Score_99%
Antiy-AVLTrojan/Generic.ASMalwS.1BED5
KingsoftWin32.Troj.Generic_a.c.(kcloud)
MicrosoftWorm:Win32/Mydoom.L@mm
GridinsoftWorm.Win32.Mydoom.ka!i
SUPERAntiSpywareWorm.MyDoom
ZoneAlarmTrojan.Win32.Fsysna.ehxz
GDataWin32.Worm.MyDoom.NF
AhnLab-V3Win32/Mydoom.worm.22020.H
Acronissuspicious
McAfeeGenericRXLN-WS!F0A4E1B9F16B
MAXmalware (ai score=85)
VBA32Backdoor.Shiz
MalwarebytesMydoom.Worm.DDoS.DDS
PandaW32/Mydoom.DN.worm
TrendMicro-HouseCallWORM_MYDOOM.GEN
RisingWorm.Mail.Win32.Mydoom.l (CLASSIC)
YandexI-Worm.Mydoom.CR
IkarusEmail-Worm.Win32.Mydoom
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/MyDoom.M@mm
AVGWin32:Mydoom-EG [Trj]

How to remove Win32.Worm.MyDoom.NF (B)?

Win32.Worm.MyDoom.NF (B) removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment