News Focus
News Focus
icon url

originunknown

01/27/04 9:32 AM

#2229 RE: az2820 #2228

Good morning! Be careful with this one, I received it twice already.

Spam-Sent MyDoom Worm Threat to PC Users

SEATTLE (Reuters) - A new computer worm called MyDoom, which is spreading across the Internet via spam, can potentially allow attackers to gain unauthorized access to personal computers, security experts said on Monday.

The new worm, also dubbed Novarg or Shimgapi, doesn't take advantage of any software flaws or vulnerabilities, but rather is designed to entice recipients of an e-mail to open an attached file and run programs contained in the attachment.


"Mailboxes at large corporations are infected and reporting multiple infections throughout their entire organizations," said David Perry, global education director at Trend Micro Inc. (4704.T)


The mass-mailing worm that arrives as an attachment with an .exe, .scr, .zip or .pif extension and can have a subject line of "test" or "status."


Users who receive the worm and simply ignore or delete it will be able to avoid any damage.


The most common attachment type appears to be .zip, experts said.


"There's a bit of a twist in that in this case you have an attached .zip, and for the attack to succeed, the user has to open the attached .zip file, and then run one of the executables(programs) that appear," said Christopher Budd, a security program manager with Microsoft Corp.'s product support group.


A .zip file is a widely-used compressed file format used to send and store large files.


MyDoom also mails itself out to addresses in the victim's computer and is clogging mail servers and degrading network performance at companies, experts said.


Budd said the fast-spreading worm, which targets computers running Microsoft's Windows with any e-mail program, had not appeared before Monday afternoon.


Security experts said they were still analyzing the virus to discover what it does to the victim computers. Some are reporting that My Doom, once fully activated, instructs Windows to load it every time Windows is started and prepares to receive instructions from another computer.


The worm appears to have a random sender's address and subject line and sometimes contains an error message such as "The message cannot be represented in 7-bit ASCII and has been sent as a binary attachment."


MyDoom is also known as Novarg, and can contain attachments other than .zip files, computer security company Symantec Corp. said in a statement.


The worm was discovered on Monday afternoon and spread so quickly that Trend Micro, Network Associates Inc., Symantec and other anti-virus companies were rating it a "high" outbreak. (With additional reporting by Elinor Mills Abreu in San Francisco)