1. Home
  2. Computing & Technology
  3. Antivirus Software

MyDoom.F worm
Email attachment characteristics

By Mary Landesman, About.com

Feb 24 2004
The attachment is randomly named based on an internal list. Some attachments may be sent as ZIP files while others will be either a .BAT, .CMD, .COM, .EXE, .SCR, or .PIF extension. If sent as a ZIP, when uncompressed the enclosed executable will have the same random name as did the ZIP file. To name the attachments, the worm selects from the following:

photo
resume
image
your_document
approved
paypal
part3
part2
part4
part1
mail2
object
website
friend
jokes
story
about
money
check
product
notes
information
textfile
posting
stuff
attachment
creditcard
details
message
readme
document

MyDoom.F avoids sending itself to addresses that contain the following strings:

.gov
.mil
acketst
arin.
avp
berkeley
borlan
bsd
essagela
example
fido
foo.
fsf.
gnu
mit.e
google
gov.
hotmail
iana
ibm.com
icrosof
ietf
inpris
irix
isc.o
isi.e
kernel
linux
msn.
math
mozilla
mydoma
nai.co
nodoma
panda
pgp
rfc-ed
ripe.
ruslis
secur
sendmail
sgi.com
slashdot
solaris
sopho
sourcef
sun.com
suppo
syma
tanford.e
unix
usenet
utgers.ed

Also see:

Explore Antivirus Software
About.com Special Features

Stay connected and entertained with reviews on tips on the latest HDTVs, cellphones and more. More >

Easy ways to connect two computers for networking purposes. More >

  1. Home
  2. Computing & Technology
  3. Antivirus Software

©2009 About.com, a part of The New York Times Company.

All rights reserved.