ZyXEL Communications 5 Series User Manual page 297

Chapter 14 Intrusion Detection and Prevention (IDP) Screens
W32/MyDoom-A is a worm that is spread by email. When the infected attachment is
launched, the worm gathers e-mail addresses from address books and from files with the
following extensions: WAB, TXT, HTM, SHT, PHP, ASP, DBX, TBB, ADB and PL. W32/
MyDoom-A creates a file called Message in the temp folder and runs Notepad to display the
contents, which displays random characters. W32/MyDoom-A creates randomly chosen
email addresses in the "To:" and "From:" fields as well as a randomly chosen subject line.
Attached files will have an extension of BAT, CMD, EXE, PIF, SCR or ZIP.
297
ZyWALL 5/35/70 Series User's Guide