Worm:Win32/Mydoom.AF@mm

Exits if the current system time is after December 12, 2005.

Copies itself as <system folder>\lsasrv.exe or <temp folder>\lsasrv.exe.

Creates registry value: lsass
with data: <system folder>\lsasrv.exe or <temp folder>\lsasrv.exe
in one of the following registry keys:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
or
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Creates registry value: Shell
with data: explorer.exe <system folder>\lsasrv.exe
in registry key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
These registry modifications cause the worm to run when Windows restarts.

Modifies the Windows hosts file, <system folder>\drivers\etc\hosts, by appending URL mappings that can prevent the infected computer from accessing some security company Web sites.

Deletes the following registry values:
TaskMon
Mydoom.h
taskmon.exe
from registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

Spreads using various peer-to-peer applications, such as Kazaa, by copying itself to share folders of these applications.

Terminates processes that have module names that contain certain text strings. 

Downloads and executes files from certain URLs.

Sends itself to e-mail addresses that it finds on the infected computer. The e-mails contain a fabricated sender, subject line, message body text, and attachment name. The worm is activated when a user opens an e-mail attachment that contains the worm. The following examples are typical of e-mails that this worm may send.

From: <spoofed>
Subject: hello
Body: Your credit card was charged for $500 USD. For additional information see the attachment
Attachment: message.zip

From: <spoofed>
Subject: Do not reply to this email
Body: Attention! New self-spreading virus!
Be careful, a new self-spreading virus called "RTSW.Smash" spreading very fast via e-mail and P2P networks. It's about two million people infected and it will be more.
To avoid your infection by this virus and to stop it we provide you with full information how to protect yourself against it and also including free remover. Your can find it in the attachment.
© 2004 Networks Associates Technology, Inc. All Rights Reserved
Attachment: rules.zip