Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

General discussion

W32.Doomhunter

Feb 14, 2004 4:21AM PST

Discovered on: February 12, 2004
Last Updated on: February 14, 2004 03:58:39 PM

W32.Doomhunter is a worm that attempts to spread to the machines that are infected with W32.Mydoom@mm variants.



Type: Worm

When W32.Doomhunter runs, it does the following:


Copies itself as %System%\worm.exe.


--------------------------------------------------------------------------------
Note: %System% is a variable. The worm locates the System folder and copies itself to that location. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
--------------------------------------------------------------------------------


Adds the value:

"Delete Me"="worm.exe"

to the registry key:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

so that the worm runs when you start Windows

Discussion is locked