W32/Mydoom.F is a mass mailing worm. This worm is a variant of W32/Mydoom. The worm will infect Windows systems and spreads through email.

The worm arrives with a random subject. The subject is a combination of words randomly chosen by the worm.

Content of the mail will be random text. It carries an infected attachment with a random filename having single or double extensions. Infected email carries a spoofed 'From' address picked up randomly from the infected system.

Upon execution, the worm copies itself with a random file names to Windows System folder. It also drops a .dll file in Windows System folder to complete its malicious activity.

To propagate itself, the worm scans the following extensions and collects the available email addresses from the infected system;

.adb, .asp, .dbx, .eml, .htm, .mbx, .mht, .mmf, .msg, .nch, .ods, .oft, .php, .pl, .rtf, .sht, .tbb, .txt, .uin, .vbs, .wab.

It also alters the windows registry at the following location to load itself during next startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The worm has a payload to performs a DOS attack to www.microsoft.com and riaa.com and the worm opens TCP port 1080 for remote connections.

This worm first appeared on 20th February, 2004.

Other names of W32/Mydoom.F Worm:

This worm is also known as W32/Mydoom.F@MM, WORM_MYDOOM.F, W32/MyDoom-F