The W32.Mydoom.F@mm worm:

Is a mass-mailing worm that opens a backdoor on TCP port 1080
Can download and execute arbitrary files
Will perform a Denial of Service (DoS) against www.microsoft.com and www.riaa.com, if the computer's local system date is between 17th and 22nd of any month.
Sets up a backdoor in an infected system, by opening TCP port 1080. This could allow an attacker to connect to a computer and use it as a proxy to gain access to its network resources.


is this port 1080 .. the same kind of port which mydoom.A opened?
I mean .. should the exploit of MyDoom.A work also on MyDoom.F?

thanks

Im not sure if it will, as its on 1080. I have tried several but none work with the mydoom.a exploit, so correct me if im wrong, but I think it doesnt work with the same exploit.

ur right .. ive tested it ..
mhh I think I need the source code of the .F version to compile a exploit ..

i have lookt at the source but the veluw name's has been change.. could be that's this is the problem?

I just need the trojan ..
its probably another code as Mydoom.A

isnt 1080 the socks proxy port?

anyone with the binary ?

mydoom had his port on 3127 not 1080 i think ;D

MyDoom port is 3127..

http://symantec.com/avcenter/venc/data/w32.mydoom.f@mm.html

yeah port 1080 is default socks proxy port, so scanning for port1080 wouldn't give you many positive results. however you could probably filter them out by use of banner scanning.