"My Doom" WORM Virus - Sitcoms Online Message Boards

Jenya · 01-27-2004, 09:47 PM

How many E-mails have you recieved yet from this WORM? It's a Zip file, and it's spreads through your E-mail address book if you open it. If you recieve this WORM- Delete it.

So far I recieved 8 E-mails from this rotten thing.

robyrob · 01-27-2004, 10:52 PM

Quote:

Originally posted by Jenya
How many E-mails have you recieved yet from this WORM? It's a Zip file, and it's spreads through your E-mail address book if you open it. If you recieve this WORM- Delete it.

So far I recieved 8 E-mails from this rotten thing.

someone that has YOU in their address book is obviously infected, if you arent already

Jenya · 01-27-2004, 11:03 PM

Quote:

Originally posted by robyrob
someone that has YOU in their address book is obviously infected, if you arent already

You mean SOME PEOPLE. I just checked my Yahoo mail. I got another 2 more WORMS in it (That makes 10). And that's not including the other 5 WORMS in my Cogeco mailbox.

This is nuts.

robyrob · 01-27-2004, 11:09 PM

Quote:

Originally posted by Jenya
You mean SOME PEOPLE. I just checked my Yahoo mail. I got another 2 more WORMS in it (That makes 10). And that's not including the other 5 WORMS in my Cogeco mailbox.

This is nuts.

worms will usually disguise the origin of the sender and depending on how they propagate, it may be busy sending itself off to everything in your address book (in other words, double check your definitions and rescan)

Jenya · 01-27-2004, 11:14 PM

Quote:

Originally posted by robyrob
worms will usually disguise the origin of the sender and depending on how they propagate, it may be busy sending itself off to everything in your address book (in other words, double check your definitions and rescan)

I'll do that. Thanks for your help!

pandora_spocks · 01-27-2004, 11:46 PM

I just got a couple emails sent back to me stating they couldn't reach so and so, but the weird thing is I never sent any email to the email addresses it listed. Plus, it had the message attached so I'm thinking maybe that could be a virus?

robyrob · 01-27-2004, 11:52 PM

Quote:

Originally posted by pandora_spocks
I just got a couple emails sent back to me stating they couldn't reach so and so, but the weird thing is I never sent any email to the email addresses it listed. Plus, it had the message attached so I'm thinking maybe that could be a virus?

if it has an attachment and you didnt send it, that would be a good assumption - scan it or delete it ASAP

robyrob · 01-28-2004, 12:04 AM

from Symantec (Norton):
http://securityresponse.symantec.com...varg.a@mm.html

W32.Novarg.A@mm is a mass-mailing worm that arrives as an attachment with the file extension .bat, .cmd, .exe, .pif, .scr, or .zip.

When a computer is infected, the worm will set up a backdoor into the system by opening TCP ports 3127 through 3198, which can potentially allow an attacker to connect to the computer and use it as a proxy to gain access to its network resources.

In addition, the backdoor can download and execute arbitrary files.

The worm will perform a Denial of Service (DoS) starting on February 1, 2004. It also has a trigger date to stop spreading on February 12, 2004.

Distribution Info:

* Subject of email: Varies
* Name of attachment: Varies with an extension of .pif, .scr, .exe, .cmd, .bat, or .zip.
* Size of attachment: 22,258 bytes
* Time stamp of attachment: n/a
* Ports: TCP 3127-3198
* Shared drives: n/a
* Target of infection: n/a

There is a removal tool, and manual removal instructions on the page i've linked above

pandora_spocks · 01-28-2004, 12:05 AM

Quote:

Originally posted by robyrob
if it has an attachment and you didnt send it, that would be a good assumption - scan it or delete it ASAP

i didn't even open it. i just deleted it from my inbox.

Jenya · 01-28-2004, 12:07 AM

Quote:

Originally posted by pandora_spocks
I just got a couple emails sent back to me stating they couldn't reach so and so, but the weird thing is I never sent any email to the email addresses it listed. Plus, it had the message attached so I'm thinking maybe that could be a virus?

I just go off the phone with my friend, and this is what he told me to do:

If you're not sure if you are infected with the virus, you can download the symantec W32.Novarg.A@mm Removal Tool. Just follow the instructions (Print them out first), then when you run the program, it will detect to see if the virus is in your computer, and it will automatically terminate it for you.

After it's done, re-boot your computer and run the program one more time, to make sure the virus is destroyed. You may also need to restore your Active Desktop when it's done.

It doesn't take long to do. Maybe five minutes at the most.

robyrob · 01-28-2004, 12:09 AM

of course the website that it is performing the DoS attack on is SCO, so you may want to participate in it

TJ · 01-29-2004, 06:02 AM

I would estimate I've received over 5000 of these virus mails. It is certainly bigger and spread faster then the Klez or Nimda virus. The bad part of this one it spoofs e-mail addresses so I am getting them from every possible combination of address like bob@sitcomsonline.com

Rhiannon · 01-29-2004, 11:28 AM

I haven't gotten any yet, luckily

Rebel Queen 1980 · 01-30-2004, 01:55 AM

Ooh that's bad!,I check my email everyday,but I know
when it's spam or anything else I don't recognize it I just
deleted it,Have been lucky so far too!

robyrob · 02-01-2004, 02:12 PM

Quote:

Originally posted by robyrob
of course the website that it is performing the DoS attack on is SCO, so you may want to participate in it

http://www.linuxstolescocode.com/

01-27-2004, 09:47 PM	#1
Jenya Supervisor Forum 3000 Club Member Join Date: Apr 20, 2003 Location: Canmore, Alberta Posts: 3,359	"My Doom" WORM Virus How many E-mails have you recieved yet from this WORM? It's a Zip file, and it's spreads through your E-mail address book if you open it. If you recieve this WORM- Delete it. So far I recieved 8 E-mails from this rotten thing.

01-29-2004, 11:28 AM	#13
Rhiannon oh, snap! Forum Fanatic Join Date: Jul 19, 2002 Location: middle of nowhere Posts: 11,097	I haven't gotten any yet, luckily
	__________________ Nothing better the feeling is so fine Simply put I saw your love stream flow

01-27-2004, 11:46 PM	#6
pandora_spocks Member Forum Celebrity Join Date: Nov 30, 2002 Posts: 21,532	I just got a couple emails sent back to me stating they couldn't reach so and so, but the weird thing is I never sent any email to the email addresses it listed. Plus, it had the message attached so I'm thinking maybe that could be a virus?

01-28-2004, 12:04 AM	#8
robyrob certified wackball#3 Moderator Forum Icon Join Date: Aug 03, 2003 Location: hiding under the third booth at Arnold's Posts: 58,200	from Symantec (Norton): http://securityresponse.symantec.com...varg.a@mm.html W32.Novarg.A@mm is a mass-mailing worm that arrives as an attachment with the file extension .bat, .cmd, .exe, .pif, .scr, or .zip. When a computer is infected, the worm will set up a backdoor into the system by opening TCP ports 3127 through 3198, which can potentially allow an attacker to connect to the computer and use it as a proxy to gain access to its network resources. In addition, the backdoor can download and execute arbitrary files. The worm will perform a Denial of Service (DoS) starting on February 1, 2004. It also has a trigger date to stop spreading on February 12, 2004. Distribution Info: * Subject of email: Varies * Name of attachment: Varies with an extension of .pif, .scr, .exe, .cmd, .bat, or .zip. * Size of attachment: 22,258 bytes * Time stamp of attachment: n/a * Ports: TCP 3127-3198 * Shared drives: n/a * Target of infection: n/a There is a removal tool, and manual removal instructions on the page i've linked above

01-28-2004, 12:09 AM	#11
robyrob certified wackball#3 Moderator Forum Icon Join Date: Aug 03, 2003 Location: hiding under the third booth at Arnold's Posts: 58,200	of course the website that it is performing the DoS attack on is SCO, so you may want to participate in it

01-29-2004, 06:02 AM	#12
TJ Site Owner Administrator Forum Star Join Date: Feb 03, 2000 Location: Marietta, GA Posts: 10,699	I would estimate I've received over 5000 of these virus mails. It is certainly bigger and spread faster then the Klez or Nimda virus. The bad part of this one it spoofs e-mail addresses so I am getting them from every possible combination of address like bob@sitcomsonline.com

01-30-2004, 01:55 AM	#14
Rebel Queen 1980 Member Senior Member Join Date: Nov 05, 2002 Location: Watching Classic Sitcoms 24/7.... Posts: 1,509	Ooh that's bad!,I check my email everyday,but I know when it's spam or anything else I don't recognize it I just deleted it,Have been lucky so far too!