W32.Mydoom.M@mm is a mass-mailing worm that drops and executes a backdoor, detected as
Backdoor.Zincite.A, that listens on TCP port 1034. The worm uses its own SMTP engine to send itself to email addresses it finds on the infected computer.
The email contains a spoofed From address, and the Subject and Body text will vary. The attachment name will also vary.
Note:
- Symantec Consumer and Enterprise products that support Worm Blocking functionality automatically detect this threat as it attempts to spread.
- Due to a decreased rate of submissions, Symantec Security Response has downgraded W32.Mydoom.M@mm from a Category 4 to a Category 3 as of July 28, 2004.
- Due to a decreased rate of submissions, Symantec Security Response has downgraded W32.Mydoom.M@mm from a Category 3 to a Category 2 as of October 27, 2004.
W32.Mydoom.M@mm is packed with UPX.
Translations of this Document:
Given the time needed to translate documents into other languages, the translated versions of this document may vary in content if the English document was updated with new information during the translation process. The English document always contains the most up-to-date information.
Available translations:
German
French
Italian
Portuguese
Spanish
Korean
Simplified Chinese
Traditional ChineseClick for a more detailed description of Rapid Release and Daily Certified virus definitions.
