ALERT: Extra caution with attachments!

chance wrote:

Yesterday and Today, I got and am still getting dozens of this kind of mails. Fortunately, the anti-virus “Bit Defender” stopped them all, in indicating that they are infected by Win32.Novarg.A@mm.

percebilla wrote:

thank you so much for the helpful explanations about viruses! I am still new to this medium and am a bit worried about an e-mail I opened the other day . It did not come directly from infoproz but rather from one "troy" with infoproz as the heading. I didn´t really take in the message as I closed it again rapidly,realising my mistake. My son ,whose PC I use is very worried I may have let in a virus... ¿Please- has anyone else received such a message from someone called troy at infoproz? I await with baited breath...

percebilla wrote:

thank you so much for the helpful explanations about viruses! I am still new to this medium and am a bit worried about an e-mail I opened the other day . It did not come directly from infoproz but rather from one "troy" with infoproz as the heading. I didn´t really take in the message as I closed it again rapidly,realising my mistake. My son ,whose PC I use is very worried I may have let in a virus... ¿Please- has anyone else received such a message from someone called troy at infoproz? I await with baited breath...

Narasimhan Raghavan wrote:

This is what I got from the magazine "About.com computer":
Url:http://65.54.168.250/cgi-bin/linkrd?_lang=DE&lah=d6f3bfae3eb942eb36f0ef9d80b53c7a&lat=1075333413&hm___action=http://slclk.about.com/?zi=1/Iqg

Worm spells MyDoom for SCO
And uses antivirus software to DoS users
Jan 28 2004
Dubbed Mydoom, Mimail.R, Novarg, or Shimg depending on the antivirus vendor, a worm discovered on January 26th, 2004 has created a headache for users. The worm spoofs the From address, causing lots of innocent folks to be blamed for sending the worm. The fact is, the one person who is most likely not to be infected is the person's whose name appears in the From field of the email.

Worse, antivirus alerts are once again contributing to the mess. As was the case with Sobig.F, the vendor alerts have become part of the Mydoom problem.
The alerting problem begans when one of the infected emails is detected by the ISP or domain antivirus solution. The antivirus software, depending on the administrator's configuration, may then send an alert to the recipient and to the alleged sender. Of course, when the sender name is falsified, this means innocent folks are accused of sending a virus when in fact they are not the infected party. The confusion and chaos only gets worse. Many of these antivirus products will send the actual infected message to this alleged sender. Meaning they have now received the virus. If they open the email and the attachment to see what it is they supposedly sent, they then risk becoming infected. The volume of erroneous antivirus alerts is so high, it is quickly outpacing the number of actual Mydoom emails. In fact, some contend that the antivirus alerts are themselves a form of DoS (Denial of Service) attack.
Using antivirus software to DoS email users is not the only trick up Mydoom's sleeve. The worm also launches a Distributed Denial of Service (DDoS) attack against the well-known UNIX vendor, SCO.com. Every second from every infected computer worldwide, the Mydoom (a.k.a. Mimail.R) sends a GET request to the website in an apparent attempt to overload the webserver.
Much controversy has surrounded SCO after claiming last December that the Linux operating system was violating their intellectual property rights in UNIX. "There are a lot of kids out there who feel like SCO's attacking them", comments Mikko Hypponen, Director of Anti-Virus Research at F-Secure Corporation. "Apparently someone of them decided that it's ok attack back."
The Mydoom worm spreads via email and the P2P network KaZaA. The email message composed by the worm has a spoofed Sender name and the Subject will be one of the following:
test
hi
hello
Mail Delivery System
Mail Transaction Failed
Server Report
Status
Error
The text of the email will be either:
The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.
- or -
The message contains Unicode characters and has been sent as a binary attachment.
- or -
Mail transaction failed. Partial message is available.
The attachment will have either an EXE, CMD, PIF, or SCR extension, or it may be a ZIP archive, and will have one of the following filenames:
document
readme
doc
text
file
data
test
message
body
The attachment's icon may appear to be an icon normally associated with a TXT file, despite the fact that the attachment itself is an executable. To mask its intentions, when executed the worm first launches Notepad, filling the page with random text. Behind the scenes, the worm drops a copy of itself to the Windows System folder (usually C:WindowsSystem) as taskmon.exe. This has caused some confusion among Windows 95/98/ME users, as there is a legitimate file named taskmon.exe, but that file resides in the C:Windows folder, not C:WindowsSystem.
Mydoom also searches the System Registry to determine if KaZaA is installed and, if so, what directory is being shared by the user. It then drops a copy of itself to the shared KaZaA folder using one of the following names and a BAT, PIF, SCR, or EXE extensions:
winamp5
icq2004-final
activation_crack
strip-girl-2.0bdcom_patches
rootkitXP
office_crack
nuke2004
This allows the worm to infect KaZaA users who download and execute one of the infected files, causing further spread on the P2P network. To spread via email, the Mimail.R (a.k.a. Mydoom) worm harvests addresses from WAB, ADB, TBB, DBX, ASP, PHP, SHT, HTM, and TXT files found on the infected system. The worm code also contains text strings which it can use to randomly create addresses if no other addresses are found.
The worm also creates the file shimgapi.dll in the WindowsSystem directory, registering this file as a child process of EXPLORER.EXE. Shimgapi.dll opens and listens on ports 3127 through 3198. This backdoor could be used to download further malicious code to the system.
Take care and good luck,
N.Raghavan