W32/Mydoom is a mass mailing worm. This worm will infect Windows systems. The worm spreads through email and KaZaA P2P software.

The worm arrives with a random subject. The subject is a combination of words randomly chosen by the worm.

Content of the mail will be random text. It carries an infected attachment with random filename with any one of the following extensions .exe, .pif, .cmd, .scr, zip. Infected email carries a spoofed 'From' address picked up randomly from the infected system.

Upon execution of the attachment, the worm opens Windows NOTEPAD.EXE and displays some garbage. It copies a file taskmon.exe to Windows system folder. The worm also copies itself as activation_crack.scr to Program Files\KaZaA\My Shared Folder. It drops a file called shimgapi.dll in the Windows System folder.

It alters the windows registry at the following location to load itself during next startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The worm scans all the files present in the infected system having the following extensions and collects all the available email addresses.

.wab, .txt, .tbb, .sht, .php, .htm, .dbx, .asp, .adb.

The worm uses its own SMTP engine to propagate itself to all these addresses.

This worm first appeared on 26th January 2004.

Other names of W32/Mydoom Worm:

This worm is also known as W32/Mydoom@MM, W32.Novarg.A@mm, WORM_MIMAIL.R