Malicious Software Encyclopedia: Win32/Doomjuice
Published:
February 2, 2005
Win32/Doomjuice is a family of worms that target machines infected with Win32/Mydoom. Win32/Doomjuice scans for systems listening on the TCP port opened by the backdoor component of Win32/Mydoom. The worms launch a denial of service (DoS) attack against www.microsoft.com.
On This Page
Threat Overview
| Class/type | Worm - Network
|
| Discovered | February 10, 2004 |
| Circulating | No |
| Affected operating systems | Windows NT 4.0
Windows 95
Windows 2000
Windows XP
Windows Server 2003
|
| Affected software |
Not specified
|
| Infection rating | Medium |
| Recovery difficulty | Moderate |
| Damage rating | Low |
| Transmission rating | Medium |
Aliases (Also Known As)
Different antivirus vendors may be using different names to refer to this malicious software. Here are some of the names currently in use by antivirus software vendors participating in the Microsoft Virus Information Alliance (VIA):
CA:
Win32.DoomjuiceMcAfee:
W32/Doomjuice.wormSymantec:
W32.HLLW.DoomjuiceTrend Micro:
WORM_DOOMJUICE
Learn more about the
Microsoft Virus Information Alliance.
Technical Analysis
When Win32/Doomjuice runs, it copies itself to the %System% or %temp% directory. The worm also adds a value to one of the following registry keys:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
The data in this registry value references the created copy of the worm. This value causes the worm to run when Windows starts.
Win32/Doomjuice may create the file sync-src-1.00.tbz in the following locations:
- root of all fixed drives c-z
- %Windows%
- %System%
- %Temp%
- %USERPROFILE%
Win32/Doomjuice randomly selects IP addresses from predefined ranges and sends itself through the port opened by a backdoor component of Win32/Mydoom, if the target system is already infected by Win32/Mydoom.
How to Prevent Infection
Take the following steps to help prevent infection on your system:
Enable a firewall on your computer
Use a third-party firewall product or turn on the Microsoft Windows XP Internet Connection Firewall.
To turn on the Internet Connection Firewall in Windows XP
Click Start, and click Control Panel.
Click Network and Internet Connections, and click Network Connections. If you do not see Network and Internet Connections, click Switch to Category View.
Highlight a connection that you want to help protect, and click Change settings of this connection.
Click Advanced, and select Protect my computer and network by limiting or preventing access to this computer from the Internet.
Click OK.
Get the latest computer updates
Updates help protect your computer from viruses, worms, and other threats as they are discovered. You can use the Automatic Updates feature in Microsoft Windows XP to automatically download future Microsoft security updates while your computer is on and connected to the Internet.
To turn on Automatic Updates
Click Start, and click Control Panel.
Click Performance and Maintenance. If you do not see Performance and Maintenance , click Switch to Category View.
Click System.
Click Automatic Updates, and select Keep my computer up to date.
Select a setting. Microsoft recommends selecting Automatically download the updates, and install them on the schedule that I specify and setting a regular update time.
If you choose to have Automatic Updates notify you in step 5, you will see a notification balloon when new downloads are available to install. Click the notification balloon to review and install updates.
Use up-to-date antivirus software
Most antivirus software can detect and prevent infection by known malicious software. You should always run antivirus software on your computer that is updated with the latest signature files to automatically help protect you from infection.
How to Tell If Your Computer Is Infected
Some customers whose computers have been infected will not notice the presence of Win32/Doomjuice at all. Other customers may notice crashes or slowdowns during normal operation.
How to Recover from Infection
Automatic Recovery
To attempt to automatically remove this threat, run one of the following removal tools:
Payload Information
| Payload type | Trigger | Description |
|---|
| Creates files | | |
