Threat level: Category 4 - Severe
Outbreak Type: Worm
The W32.Mydoom.M@mm mass-mailing worm:
- Uses its own SMTP engine to send itself to all the email addresses that it finds from an infected system.
- The email has an attachment with a .bat, .cmd, .com, .exe, .pif, .scr, or .zip extension.
- The attachment name may contain a randomly selected domain, which was found on the sender's system.
For example, the attachment name could contain fakedomain.com if the address
x@fakedomain.com was harvested.
- The From field of the email is spoofed.
- Downloads and executes a backdoor, which is detected as Backdoor.Zincite.A, on port 1034/tcp.
- Is packed by UPX.
For more technical details on W32.MyDoom.M@mm, please see the Symantec Security Response
SOURCE:
www.symantec.com 
Linear Mode
