W32/Doomjuice.A is an internet worm. This worm spreads to Windows systems. The worm targets and spreads to systems infected with W32/Mydoom and W32/Mydoom.B worm, it enters through the backdoor created by the W32/Mydoom variants.

Upon execution, the worm copies itself as intrenat.exe in the Windows System folder. It also creates an backup of W32/Mydoom source code and copies it as sync-src-1.00.tbz to the following locations;

Root of C drive
Windows folder
Windows System folder

The worm also creates a mutex sync-Z-mtx_133 to ensure a single copy is running in the memory.

It alters the Windows registry at the following location to load itself during next startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

To propagate itself, the worm contacts the W32/Mydoom infected systems, scans for random IP addresses and connects TCP port 3127 to send a copy of itself to the remote systems. It also attempts to execute the worm.

It has a payload to perform a Denial of Service (DoS) attack on microsoft.com on systems date between Feb 9 to 12.

This worm first appeared on 9th Febuary, 2004.

Other names of W32/Doomjuice.A Worm:

This worm is also known as W32.HLLW.Doomjuice, W32/Doomjuice.worm.a, WORM_DOOMJUICE.A, Doomjuice.A, W32/Doomjuice-A.