Worm:Win32/Sober.D@mm

Creates three files in %windir%\system32 with randomly-generated names such as:
logwindata.exe
diagexplorer.exe
syslogdata.exe
service32.exe

Displays the message: "This patch has been successfully install."

Adds a randomly named registry value
with data: %windir\system32\<random>.exe
to registry keys:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\<random key name>
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\<random key name>
These modifications cause the worm to run whenever Windows starts.

Saves e-mail addresses that it finds on the infected computer to %windir%\system32\mslogs32.dll.

Sends itself to these e-mail addresses. The e-mails include a fabricated sender, subject line and message body text, and an attachment or a link to Web site. The following example is typical of e-mails sent by this worm:

From: <spoofed>
Subject: Microsoft Alert: Please Read!
Message Body: New MyDoom Virus Variant Detected!
A new variant of the W32.Mydoom (W32.Novarg) worm spread rapidly through the Internet.
Please download this digitally signed attachment.
Anti-virus vendor Central Command claims that 1 in 45 e-mails contains the MyDoom virus.
The worm also has a backdoor Trojan capability.
By default, the Trojan component listens on port 13468.
Protection:
This Update includes the functionality of previously released patches.
Attachment Name: sfsdf
Attachment Extension: .zip