W32/Mydoom.AB Worm

 Information about the W32/Mydoom.AB Worm:

W32/Mydoom.AB is an email worm. This worm is a variant of W32/Mydoom  worm. The worm will infect Windows systems. The worm spreads through email, ICQ and KaZaA P2P software.

The worm arrives with a random subject. The subject is a combination of words randomly chosen by the worm. Content and attachment of the mail will be random.

Upon execution, the worm copies itself as services.exe on to the Windows folder. This file runs as a service.

It also alters the windows registry at the following location to load itself during next startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

To propagate itself, the worm scans the following extensions and collects the available email addresses from the infected system;

.asp, .cfg, .cgi, .dbx, .dht, .eml, .htm, .jsp, .mbx, .mht, .msg, .php, .sht, .stm, .tbb, .txt, .uin, .wab, .xls


The worm alters the hosts file and deny connection to antivirus and security related sites.

The worm emails itself to these addresses using its own SMTP engine.

This worm first appeared on 15th September, 2004.

 Other names of W32/Mydoom.AB Worm:

This Worm is also known as W32.Mydoom.AB@mm , MyDoom.AB, W32/Mydoom.ab@MM.