Virus Warning W32/Mydoom.A-mm

AranyicAranyic Casstown, OH Icrontian
edited March 2004 in Science & Tech
Just a heads up to everyone, a new virus is really getting around (I got 7 emails for it in 4 hours). Norton at least right now does not detect it:
Warning: Mydoom virus spreading rapidly

MessageLabs, the leading provider of managed email security services to businesses worldwide, has intercepted a high number of copies of a new worm known as W32/Mydoom.A-mm.

Name: W32/Mydoom.A-mm
Number of copies intercepted so far: 165,598
Time & Date first captured: 13.03pm GMT, 26th Jan 04
Origin of first intercepted copy: Russia

W32/Mydoom.A-mm is a mass-mailing worm that attempts to spread via email and by copying itself to any available shared directories used by Kazaa.

The worm harvests addresses from infected machines and targets files with the following extensions:
.wab, .adb, .tbb, .dbx, .asp, .php, .sht, .htm, .txt.

W32/Mydoom.A-mm also tries to randomly generate or guess likely email addresses to send itself to.

In addition, initial analysis suggests that Mydoom opens a connection on TCP port 3127, an indication of a remote access component.

Email characteristics:

From: Random, spoofed email address

Subject: Random

Text: Various, including:

· The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.

· The message contains Unicode characters and has been sent as a binary attachment.

· Mail transaction failed. Partial message is available.

Attached file: Various,extensions including .exe, .pif, .cmd, .scr. The attachment often arrives in a zip archive, and is also represented by what appears to be a text file icon, but is in fact an executable.

Size: 22,528 bytes

Comments

  • verselloversello New
    edited January 2004
    Tx for the heads-up.

    Too bad I don't need to worry :D

    /me pats his powerbook lovingly
  • PyobliEPyobliE UK
    edited January 2004
    Originally posted by versello


    * versello pats his powerbook lovingly

    Do Macs get many Virus'? I would imagine that as less people use it, then less people make virus for it? Not really herd much about mac virus.....
  • CoasterCoaster
    edited January 2004
    Just recieved one zipped up and was made to look like a shortcut (it has its own icon) it was actually a .pif file.

    Norton now DOES detect it (as of just this minuite), only as a varient called NOVARG
    http://securityresponse.symantec.com/avcenter/venc/data/w32.novarg.a@mm.html
  • verselloversello New
    edited January 2004
    Originally posted by PyobliE


    Do Macs get many Virus'? I would imagine that as less people use it, then less people make virus for it? Not really herd much about mac virus.....

    That's certainly a good point you make - less people use Macs, therefore there really isn't a market for antivirus software and viruses.

    To my knowledge I haven't experienced/heard of any viruses for the Mac although I'm sure there's maybe a couple that exist in its long history.
  • stoopidstoopid Albany, NY New
    edited January 2004
    I had my first email virus through my roadrunner account last night (text.exe was detected as a worm). That's in 4 years of having roadrunner. Of course Norton caught it...
  • kryystkryyst Ontario, Canada
    edited January 2004
    Yup I got 7 in this morning in various states of attachments or giberish.

    Norton didn't detect it but it will now.
  • PyobliEPyobliE UK
    edited January 2004
    Originally posted by versello


    That's certainly a good point you make - less people use Macs, therefore there really isn't a market for antivirus software and viruses.

    To my knowledge I haven't experienced/heard of any viruses for the Mac although I'm sure there's maybe a couple that exist in its long history.

    Yea, I thought that was the case, less people use Macs means less people effected by a mac virus, so less of a 'kick? ( I dont claim to have an insight into the mind of a virus maker...) for the lowlife who wrote it. Is Mac antivirus software not even available? Cant get Mac Norton for example?
  • CoasterCoaster
    edited January 2004
    10 in the last hour - isnt life funny :rolleyes:
    Of course those who have a firewall and virus protection dont open attachments that they are unsure of will never get infected :)

    But of course the biggest defence is the user and not even programs or filters. To spread it needs someone to open and run the dam script. The volume of people who open anything and everything they get is crazy!

    Everyone who does adds to the problem and so I have no sympathy for them.

    1) Install a anti-virus program
    2) Check if you know the person sending the file, if not does the attachment and email message tie in with your work ie for me, is it screenshots or a press release?
    3) Do not use the address book in outlook
    4) Be weary of programs like kazaa

    Simple rules will eradicate most outbreaks... but still it seems to spread and spread....
  • verselloversello New
    edited January 2004
    Originally posted by PyobliE


    Yea, I thought that was the case, less people use Macs means less people effected by a mac virus, so less of a 'kick? ( I dont claim to have an insight into the mind of a virus maker...) for the lowlife who wrote it. Is Mac antivirus software not even available? Cant get Mac Norton for example?

    Yea you can get Norton, but apparently McAfee is supposed to be better on the mac.
  • CoasterCoaster
    edited January 2004
    i'ld like to see the amount of viruses is protects against :D
  • drowddrowd Texas
    edited January 2004
    yeah, and another thing, those of you that still use internet explorer, tons of those exploits that ad-aware and the like pick up on dont apply if you use a different browser (SHAMELESS OPERA PLUG :D) like opera or firebird, then you will not get as many of those. I hardly ever have to run ad-aware anymore . . .
  • kanezfankanezfan sunny south florida Icrontian
    edited January 2004
    i cleaned this off computers at my office this morning. i'd like to catch these virus writing morons and kill them
  • stoopidstoopid Albany, NY New
    edited January 2004
    We're getting hit with a lot of calls about this at work today. Fortunately our firewall was updated overnight and we've had no confirmed cases of infection internally.
  • CoasterCoaster
    edited January 2004
    Originally posted by kanezfan
    i cleaned this off computers at my office this morning. i'd like to catch these virus writing morons and kill them

    agreed
  • NebulousNebulous New York, The Empire State
    edited January 2004
    Well did a complete scan twice and updated the firewall and antivirus. My rig is clean as a hound's tooth.

    Thanx for the heads up ;)
  • AranyicAranyic Casstown, OH Icrontian
    edited January 2004
    Just got this:
    Updated at 14.20 GMT/09.20 New York/01.20 Sydney

    MessageLabs has now intercepted 1.2 million copies of W32/Mydoom.A-mm. The company is processing between 50,000 and 60,000 copies of the worm an hour. To date, the worm's peak infection rate is 1 in 12 of all email scanned be MessageLabs. So far, the worm has been seen in 168 countries.

    W32/Mydoom.A has exceeded the infamous SoBig.F virus in terms of copies intercepted, and the number continues to rise
  • NebulousNebulous New York, The Empire State
    edited January 2004
    Dayum! :eek:
  • stoopidstoopid Albany, NY New
    edited January 2004
    Yeah, we have some people who arrived at work this morning with a dozen of these awaiting their delete key (of course they call me to ask if they've been infected for just looking at the subject field :rolleyes: ).
  • AranyicAranyic Casstown, OH Icrontian
    edited January 2004
    Update:
    Updated at 13.20 GMT/08.20 New York/00.20 Sydney

    MessageLabs has now intercepted around 2.2 million copies of W32/Mydoom.A-mm. The top three countries the company is seeing copies sent from are the US (40%), the UK (22%) and Australia (5%). So far, the virus has been active in 206 countries.

    The infection ratio currently stands at around 1 copy of Mydoom per 17 emails scanned.
  • eekphotoeekphoto nyc
    edited February 2004
    i am getting tons of "returned emails" too, with this virus that i never sent. at least i don't recognize any of the addresses. is there anything that can be done? i am afraid i might be passing them on through my mailbox addresses.
    i have a mac.
  • stoopidstoopid Albany, NY New
    edited February 2004
    Originally posted by eekphoto
    i am getting tons of "returned emails" too, with this virus that i never sent. at least i don't recognize any of the addresses. is there anything that can be done? i am afraid i might be passing them on through my mailbox addresses.
    i have a mac.

    Nope, it's called 'spoofing'. When the person becomes infected the virus uses names from their address book as the sender (the 'from' field). If the email delivery fails, then it automatically goes back to the sender/from field.
  • eekphotoeekphoto nyc
    edited February 2004
    thank you! so are you saying that my friends and fam are safe?
  • stoopidstoopid Albany, NY New
    edited February 2004
    Originally posted by eekphoto
    thank you! so are you saying that my friends and fam are safe?

    More than likely. Have them run a system scan anyway to be 100% sure.
  • eekphotoeekphoto nyc
    edited February 2004
    thanks very much, i'll do that.
  • stoopidstoopid Albany, NY New
    edited February 2004
    New Virus, got clobbered at work today. Argh!

    http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=101034
  • CoasterCoaster
    edited February 2004
    Just a mutant isnt it? Rather than a new virus?
  • stoopidstoopid Albany, NY New
    edited February 2004
    Coaster wrote:
    Just a mutant isnt it? Rather than a new virus?

    No, think it's legitimately new. Requires new dat files as well...
  • CoasterCoaster
    edited February 2004
    dam :o

    It's a bad month for Microsoft!
  • stoopidstoopid Albany, NY New
    edited March 2004
    Unstuck, there's so many variations and virus floating around right now this thread is like putting warning labels on cigarettes :p
Sign In or Register to comment.