|
 |
|
VIRUS ALERT!
1-27-2004
W32/Mydoom@MM
is a
HIGH-OUTBREAK mass-mailing worm
flooding email servers
worldwide. When run, the worm
steals email addresses from the
infected machine and also
automatically generates random
email addresses for propagation.
This email generation engine is
similar to technologies spammers
use to generate addresses for
spam email campaigns.
W32/Mydoom@MM generates
emails with a spoofed "From:
field", so incoming messages may
appear to be from people you
know. Furthermore, the subject
line and message body are both
randomly generated by the worm.
|
Caution—An infected
email can come from
addresses you recognize
and may contain the
following information:
|
|
|
From:
randomly generated
(spoofed)
Subject:
randomly generated
Body:
randomly generated—examples:
 | The message
cannot be
represented in 7-bit
ASCII encoding and
has been sent as a
binary attachment.
|
| The message
contains Unicode
characters and has
been sent as a
binary attachment.
|
| Mail transaction
failed. Partial
message is
available.
|
Attachment:
randomly generated
The icon used by the
file tries to make it
appear as if the
attachment is a text
file. The attachment
type varies [.exe, .pif,
.cmd, .scr]—often
arrives in a ZIP
archive. (filesize
= 22,528 bytes)
Aliases:
Novarg, W32.Novarg.A@mm,
Win32/Shimg,
WORM_MIMAIL.R
|
|
|
|
|
|
|
|
Copyright 2002 - Your Company - All Rights
Reserved |
|
