W32.Mydoom.AG@mm is a mass-mailing worm. It uses its SMTP engine to send emails. 1. Creates the following copies of itself: %System%\lsasrv.exe %System%\version.ini [path of execution]\hserv.sys 2. Adds to auto start using Shell value: "Shell" = "explorer.exe %System%\lsasrv.exe" 3. Infects the HOSTS file. Blocks access to antiviral sites and to Microsoft update. 4. Sends e-mails.
Removal: Remove it from startup using antivirus (also check How To Remove section)Startup Optimizer. Restore the HOSTS file using antivirus (also check How To Remove section)Anti-Spyware. Stop the service and set it to disabled state. Remove files.
Home
