[Site Home] [Forum Home] [Articles] [File DB] [News Archives]
Networks/Telecom/Security -> *MyDoom virus alert*
(View original topic)
| brandon - Jan-30-2004 server time | ||
I did, before I did a reformat. |
| Red Squirrel - Jan-29-2004 server time |
Oh... I see, I somehow did not catch on to that part.  |
| manadren - Jan-29-2004 server time | ||||
Someone needs to start reading his own posts  |
| Red Squirrel - Jan-28-2004 server time |
| What does SCO have to do with this though? |
| manadren - Jan-28-2004 server time |
| Another day, another Outlook\OE virus... Howevr, SCO is offering some like a $25k bounty for the guy who wrote this one. Hope somebody collects soon  |
| Chris Vogel - Jan-28-2004 server time |
| I thought you used Thunderbird, Brandon. Anyway, all these viruses! I hope my mother doesn't open one. I pretty much trust her though. She's getting geekier by the month.  |
| brandon - Jan-27-2004 server time |
| Not all of the files are zip, one of them is an exe. Anyway, I have it set so OE doesn't open attachments, or download messages when I preview them, and I also have OE set to use IE's restricted sites zone for a great deal of security. In other words, I am almost invulnerable to email viruses. |
| Red Squirrel - Jan-27-2004 server time |
| You can open the zip file, but if it's you open the file inside. But other security measures such as an A/V should stop it anyway, but I never take chances. |
| brandon - Jan-27-2004 server time |
| I can open it with no problems, because OE's setup on my computer is very secure. I don't even get emails. I feel lonely  Anyway, I haven't seen a virus in my email since the Swen days. |
| Red Squirrel - Jan-27-2004 server time |
| MyDoom prevention and cure By Robert Vamosi (1/26/04) MyDoom is a mass-mailing worm that masquerades as a test message. MyDoom (w32.mydoom@mm, also known as Novarg, Shimgapi, Shimg, and MiMail.r) takes advantage of the ZIP file format's ability to pass through e-mail filters. It also uses Kazaa to spread. Within the first few hours, MyDoom spread quickly around the world. It affects only Windows users, not those using Macintosh, Linux, or Unix. Much of the worm's code is itself encrypted, and antivirus firms are still studying it. Because MyDoom spreads via e-mail and could severely slow or shut down e-mail servers with excess traffic, this worm rates a 7 on the CNET Virus Meter. How it works MyDoom arrives as e-mail with the subject line "Mail Delivery System," "Test," or "Mail Transaction Failed.” The body text reads: "The message contains Unicode characters and has been sent as a binary attachment." The attached files are one of the following: document.zip document.pif doc.scr readme.exe file.zip message.zip oia.zip text.zip When the worm is executed, MyDoom adds the following to the Windows/System subdirectory: shimgapi.exe taskmon.exe If you are running the file-sharing program Kazaa, MyDoom will add a file named activation_crack.scr in this location: C:\Program files\Kazaa\My Shared Folder\. The worm appears to install programs on infected computers, however, the programs themselves are encrypted. MyDoom is known to open Windows Notepad and display garbage text; it is also thought to be flooding SCO.com with a denial-of-service attack. In addition, the security company iDefense and McAfee are reporting that MyDoom opens port 3127 to listen for commands from a remote attacker. Prevention If you receive MyDoom, do not open the attached file. Delete the e-mail. Removal Almost all antivirus software companies have updated their signature files to include this worm. This will stop the infection upon contact and in some cases will remove an active infection from your system. For more information, see Central Command, Computer Associates, F-Secure, McAfee, Norman, Sophos, Symantec, or Trend Micro. |
(Showing 50 last posts, newest on top)