W32/Mydoom.H is a mass mailing worm. This worm is a variant of W32/Mydoom. The worm will infect Windows systems and spreads through email.

The worm arrives with any of the following subject;

your chance
we're unable to process your request
we're experiencing technical problems
unknown
some stuff
read!!!
please read
photo
my photos
missed
micro$oft must die. support us!
just some stuff
join
i need you
i can tell you the future
hey!
excuse me
corrupted
beauty
Your profile
Your file is attached
Your document is attached
Your account is expired
Your account is about to be expired
Warning
Test
See you soon
See you
See the attached message
See the attached file for details
See the attached document
See attachment
Reply Rejected
Registration rejected
Read this
Read the document
Read the attached message
Re: Please, reply
Please, read and let me know what do you feel
Please read the attached file
Please have a look at the attached file
Open the document
Okay
Ok
Microsoft
Micro$oft
Look at the document
Look at the attached file
Interesting
Hi! Check the attachment for details
Here it is
Here is the file
Here is the document
Full message is in the attached document
For your eyes only
Expired account
Empty Details are in the attached document
Bank information
Automatic notification
Auto-reply
Attention
Alert
Address verification

Content of the email body will be similar to subject.

It carries an infected attachment with a random filename having single or double extensions. Infected email carries a spoofed 'From' address picked up randomly from the infected system.

Upon execution, the worm copies itself as a random file name with any of the following extensions .exe, .bat, .scr .pif, .cmd to Windows System folder.

It also alters the windows registry at the following location to load itself during next startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The worm scans for the hard disk to collect the email addresses present in the infected system. It uses its own SMTP engine to propagate itself to those addresses.

The worm has a payload to performs a DOS attack to www.symantec.com and also opens TCP port 1080 to give access to the hackers.

This worm first appeared on March 3rd, 2004.

Other names of W32/Mydoom.H Worm:

This worm is also known as W32/Mydoom.H@MM, WORM_MYDOOM.H, W32/MyDoom-H