MyDOOM Virus Warning

Status
Not open for further replies.
N

neobyte

Well-Known Member
Joined
Oct 30, 2003
Messages
387
Reaction score
6
Location
Durban
Anti Virus software on the mail server this morning started picking up MyDoom.a and MyDoom.b. Anyone else being hit my this. Looking at the details of this virus, I hope everyone is updating their anti virus software (if it is not too late). Apparently it also changes the host file on the computer to set all anti virus software websites to 0.0.0.0. So, If you have not yet updated your software, dont think you will be able to, unless you reset your host file.

As of this morning it does not look as if the Telkom Mail Server was picking it up.

MyDoom.a performs a DOS attack on sco.com.
MyDoom.b performs a DOS attack on microsoft.com

Both come across via email and KaZaa (so all P2P user be careful)

<b>Email</b>

Worm spreads by sending itself to e-mail addresses that are taken from files with WAB, PL, ADB, TBB, DBX, ASP, STL, HTM, TXT and PHP extension.

Emails come with the following headings:

<i>Subject:</i>
Is generated from the following words:
Error
Status
Server Report
Mail Transaction Failed
Mail Delivery System
hello
hi

<i>Body:</i>
Is generated from the following text variants:
Mail transaction failed. Partial message is available.
The message contains Unicode characters and has been sent as a binary attachment.
The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.


<i>Attachment name:</i>
Is generated from the following words:
body
message
test
data
file
text
doc
readme
document


<i>Attachment extension could be:</i>
bat
cmd
exe
scr
pif


<b>Kazaa</b>

Worm copies itself into KaZaA directory with following names:
nuke2004
office_crack
rootkitXP
strip-girl-2.0bdcom_patches
activation_crack
icq2004-final
winamp5

As many of the ADSL users use KaZaa it would be advisable to check you Shared Folders.

MyDoom.b contains variants of the above.

MAKE SURE YOU UPDATE YOUR ANTI VIRUS SOFTWARE

I Use AVG home edition which is free, and I've found it to be really good.
 
Um, the kazaa one is new to me, so thanks for that info (although I never p2p)

however, the virus have been around for the last couple of days, yet you find out about it now? shame man! l[:p] [:o)] [;)] [:D]
 
Actually, I know it has been around for a while. Only today, it has started to really go through the mail server. One in about every 5 of the emails going through my server are infected (all incoming). Surprisingly, most of the incoming emails are local.

One day when you are big and run your own IT division, then you too can deal with the stress of it all.
 
Hi guys,

I just had a variant with a subject of random characters and no text in the body - just the evil code attached as a zip file.




South Africa needs World Class Broadband at World Competitive Prices.
 
[:D] i know

and thats why i dont add **** to my address book at all... i'd rather use my 146 iq to remember them... [;)]
 
If you had a 146 iq you'd know to at least write them addys down [:D] hehehehe just j/k

AVG is very good i use it as well, just remember everyone should update their definitions asap cos the B-variant will block access to over 60 virus vendors' update sites.. pity these ppl don't use their intelligence for good things.. MyDoom.a has slowed general internet performance by 8-10% according to CNN, and that's quite a moer load of bandwidth.. many terabits us okes could make much better use of [;)]

<u>________________________________________________</u>
Just imagine where SA would be now if it weren't for Telkom
 
Microsoft.com? No.. acording to the bugtraq reports it just attacks sco.com

Anyway, my servers havent actualy passed or recived that many of them in relation to the ammount of other spam and email we recive so I personaly think its just another bloody mail virus, nothing incredible.

<hr noshade size="1">
"Since light travels faster than sound, people appear bright until you hear them speak."

NetLink Research
 
AVG is pretty good until you actually have a virus. Had virus problems last year which AVG detected but could not clean. Downloaded a free 30 day trial from srnmicro.com which cleaned it up.
 
I found this somewhere :

"<font color="blue">What I found...

Even if the virus (Mydoom) is programmed in assembler and compiled using masm it is made to look like it has been programmed in C++ when disassembling. It is a fact that many more information are hidden and undiscovered to this date such as the fact that it will stop spreading on febuary 12 which is not true. Mydoom will pass in a new phase upon febuary 12 and it will be very much more serious as it will be updated and will mutate in Mydoom.C. The backdoor (shimgapi.dll) is open a port but this is used to obscur the real intention of Mydoom.B as well as Outlook express.

It was also unknown that the virus infects the BIOS of the computer it infects by injecting a 624bytes backdoor written in FORTH which will open port tcp when Mydoom will be executed AFTER febuary 12.
<font color="black"><font size="1"> edited: 9th Feb 2004</font id="size1"> This part is not true - mydoom does not infect the BIOS </font id="black">

It is a conclusion that the viral professionals that published diagnosis of the Mydoom.A virus are trying to hide something or are very incompetent.

Also there are no way to fix the virus that is injected in the BIOS after it has been infected except from flashing it AFTER disinfecting the workstation that was infected.

Juari Bosnikovich</font id="blue">"

could be true could be false - we will find out
 
<blockquote id="quote"><font size="1" face="Verdana, Arial, Helvetica" id="quote">quote:<hr height="1" noshade id="quote">Juari Bosnikovich

could be true could be false - we will find out<hr height="1" noshade id="quote"></blockquote id="quote"></font id="quote">
Dunno about you, but this guy sounds like a real moron.

<hr noshade size="1">mithrandi, i Ainil en-Balandor, a faer Ambar
 
<blockquote id="quote"><font size="1" face="Verdana, Arial, Helvetica" id="quote">quote:<hr height="1" noshade id="quote"><i>Originally posted by mithrandi</i>
Dunno about you, but this guy sounds like a real moron.
<hr height="1" noshade id="quote"></blockquote id="quote"></font id="quote">

Actually not.

<font color="blue">What is in blue type is Juari</font id="blue">. In black type is me.

who's the moron ? <font color="blue">the blue</font id="blue"> or the black?.

If you mixed the <font color="navy">black & blue </font id="navy">.... <font color="red">well</font id="red"> ......
 
<blockquote id="quote"><font size="1" face="Verdana, Arial, Helvetica" id="quote">quote:<hr height="1" noshade id="quote">It was also unknown that the virus infects the BIOS of the computer it infects by injecting a 624bytes backdoor written in FORTH which will open port tcp when Mydoom will be executed AFTER febuary 12.<hr height="1" noshade id="quote"></blockquote id="quote"></font id="quote">

A TCP backdoor? in a BIOS? Written in FORTH??

As a fellow scientist, I have to agree with mithrandi.

<hr noshade size="1">
"Since light travels faster than sound, people appear bright until you hear them speak."

NetLink Research
 
<blockquote id="quote"><font size="1" face="Verdana, Arial, Helvetica" id="quote">quote:<hr height="1" noshade id="quote"><i>Originally posted by Karnaugh</i>
As a fellow scientist, I have to agree with mithrandi.<hr height="1" noshade id="quote"></blockquote id="quote"></font id="quote">
mmm ..... [;)]

go here guys .......

http://playground.sun.com/1275/mejohnson/
 
Whats your point?

How does someone open a socket in windows (the target OS of this virus i'm assuming) from the BIOS?

Or does it have it's own full TCP-IP stack that it somehow integrates (in 624bytes) into the BIOS?

<hr noshade size="1">
"Since light travels faster than sound, people appear bright until you hear them speak."

NetLink Research
 
<blockquote id="quote"><font size="1" face="Verdana, Arial, Helvetica" id="quote">quote:<hr height="1" noshade id="quote">How does someone open a socket in windows (the target OS of this virus i'm assuming) from the BIOS?

Or does it have it's own full TCP-IP stack that it somehow integrates (in 624bytes) into the BIOS?<hr height="1" noshade id="quote"></blockquote id="quote"></font id="quote">
It's written in FORTH; you can do absolutely ANYTHING in FORTH. I bet you Superman's flying abilities were hardcoded into his brain's firmware in FORTH.

<hr noshade size="1">mithrandi, i Ainil en-Balandor, a faer Ambar
 
Status
Not open for further replies.
Back
Top
Sign up to the MyBroadband newsletter
X