Dozer refers to malware components used in coordinated attacks that disrupted United States and South Korean government, financial, and media websites. W32.Dozer is a dropper sent by W32.Mytob!gen to email addresses harvested from compromised computers. When a recipient executes the attachment, it installs Trojan.Dozer and W32.Mydoom.A@mm, continuing a propagation chain involving Mytob. Trojan.Dozer acts as a backdoor, connects to designated IP addresses over TCP ports 53, 80, and 443, and accepts commands to update itself or report distributed-denial-of-service status. It can launch HTTP GET or POST, UDP, ICMP, TCP ACK, or TCP SYN floods against predetermined sites.