Worm:Win32/Mydoom.H@mm

Copies itself as %System%\<random>.exe, %System%\<random>.scr, %Temp%\<random>.exe or %Temp%\<random>.scr.

Creates registry value: <random>
with the created file name as data
in registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
or
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
This causes the worm to run when Windows starts.

Creates %System%\<random>.dll or %Temp%\<random>.dll, which functions as a proxy backdoor listening on ports 80 and 1080 for remote commands.

Modifies the default values of the following registry keys to reference the .dll file:
HKEY_CLASSES_ROOT\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32
HKEY_CLASSES_ROOT\CLSID\{35CEC8A3-2BE6-11D2-8773-92E220524153}\InprocServer32
These modified registry values cause Explorer.exe to load the .dll.

Terminates processes and deletes files related to antivirus software and other worms.

Create copies of itself with randomly generated file names in folders on drives from C to Z. The worm may also search for files with certain extensions and copy itself with the same file name followed by the extension .exe or .scr. If the file is a .pif, the worm may replace the file with its own copy.

Creates multiple threads that continuously send HTTP GET requests on TCP port 80 to www.symantec.com. The DoS attack is not triggered or stopped by a particular date.

Modifies the following registry key values to disable application and system services:

Retrieves e-mail addresses from files and address books on the infected computer. The worm sends a copy or .zip archive of itself to these addresses. It does not send e-mail to addresses that contain certain strings in the domain or sender name. The worm generates the attachment file name, e-mail subject, sender address, and body content from a predefined list of strings combined with randomly generated strings. The worm may also spoof the sender address using the found addresses.