http://www.microsoft.com/security/antivirus/mydoom.asp
How to Tell If a Computer Is Infected with Mydoom.A or Mydoom.B
To find out whether your computer is infected, use one of the following procedures.
First, find out which operating system you use.
If you use Windows XP, Windows 2000, or Windows NT 4.0
To find out if a computer is infected, do the following:
Click Start, and then click Run.
In the Open box, type:
cmd
Click OK. The black Command Prompt window will open, displaying C:\...>.
Type cd \ and press ENTER. This will change the current directory to C:\ followed by a cursor.
To check for Mydoom.A, click the cursor, and then type:
dir shimgapi.dll /a /s
Press ENTER.
Wait a few moments:
If File Not Found is displayed, the computer is not infected with Mydoom.A.
If Total Files Listed is displayed (see Figure 1 for details), the computer is infected with Mydoom.A. Contact your antivirus vendor.
To check for Mydoom.B, click the cursor, and then type:
dir ctfmon.dll /a /s
Press ENTER.
Wait a few moments:
If File Not Found is displayed, the computer is not infected with Mydoom.B.
If Total Files Listed is displayed (see Figure 2 for details), the computer is infected with Mydoom.B. Follow the steps below.
If you use Windows Millennium Edition, Windows 98, or Windows 95
To find out if a computer is infected, do the following:
Click Start, and then click Run.
In the Open box, type:
command
Click OK. The black Command Prompt window will open, displaying C:\...>.
Type cd \ and press ENTER. This will change the current directory to C:\ followed by a cursor.
To check for Mydoom.A, click the cursor, and then type:
dir shimgapi.dll /a /s
Press ENTER.
Wait a few moments:
If File Not Found is displayed, the computer is not infected with Mydoom.A.
If Total Files Listed is displayed (see Figure 3 for details), the computer is infected with Mydoom.A. Contact your antivirus vendor.
To check for Mydoom.B, click the cursor and then type:
dir ctfmon.dll /a /s
Press ENTER.
Wait a few moments:
If File Not Found is displayed, the computer is not infected with Mydoom.B.
If Total Files Listed is displayed (see Figure 4 for details), the computer is infected with Mydoom.B. Follow the steps below.
Top of page
What to Do If Your Computer Is Infected with Mydoom.B
If your computer is infected, first consult your preferred antivirus vendor to get the latest updates and information. If you are unable to access your antivirus vendor's website, you can regain access by using one of the following procedures.
For Windows XP, Windows 2000, and Windows NT 4.0
Click Start, and then click Run.
In the Open box, type:
cmd.
Click OK. The black Command Prompt window will open, displaying C:\...>.
Type cd \ and press ENTER. This will change the current directory to C:\ followed by a cursor.
Click the cursor and:
Type:
del /F %systemroot%\system32\drivers\etc\hosts
Press ENTER.
Type:
echo # Temporary HOSTS file >%systemroot%\system32\drivers\etc\hosts
Press ENTER.
Type:
attrib +R %systemroot%\system32\drivers\etc\hosts
Press ENTER.
After typing these commands, do one of the following:
If you use Windows NT 4.0, restart your computer.
If you use Windows XP or Windows 2000, do not restart your computer. Instead, do the following:
Type:
ipconfig /flushdns
Press ENTER.
For Windows Millennium Edition, Windows 98, and Windows 95
Click Start, and then click Run.
In the Open box, type:
command.
Click OK. The black Command Prompt window will open, displaying C:\...>.
Type cd \ and press ENTER. This will change the current directory to C:\ followed by a cursor.
Click the cursor and:
Type:
del c:\windows\hosts
Press ENTER.
Top of page
Visit Antivirus Software Vendors for More Information
If your computer is infected with either Mydoom.A or Mydoom.B and you need technical assistance, contact your antivirus vendor or Microsoft Product Support Services for help removing the worm.
For Microsoft Product Support Services in the United States and Canada, call toll free (866) PCSAFETY (727-2338).
For Microsoft Product Support Services outside the United States and Canada, visit the Product Support Services Web page.
Find additional information and resources from antivirus software vendors participating in the Microsoft Virus Information Alliance:
McAfee
Trend Micro
Symantec
Computer Associates
