Cunny78 Posted February 17, 2005 Report Share Posted February 17, 2005 Just got this email, - ORANGE ALERT: Mydoom.AO. Internet search engines, once again in the sights of a computer virus - Virus Alerts, by Panda Software (http://www.pandasoftware.com) Madrid, February 17, 2005 - PandaLabs has detected the appearance of a new worm that uses Internet search engines to spread rapidly: Mydoom.AO. This worm uses Google, Altavista, Yahoo and Lycos to search for email addresses to which to send itself. In this way, a single infected computer can distribute thousands of copies of the worm in just a few minutes. This means that probability of a computer becoming infected by the Mydoom.AO worm is high. Panda Software clients that already have TruPrevent Technologies to protect against unknown viruses and intruders, have had preventive protection against Mydoom.AO from the moment it first appeared as they are able to detect and block this threat without needing to have identified it previously (more information about the new TruPrevent Technologies at http://www.pandasoftware.com/truprevent). Mydoom.AO uses so-called 'social engineering' to try to trick users, as the email messages it spreads in appear to be mail delivery error messages, these include: Message could not be delivered, Mail System Error - Returned Mail, or Delivery reports about your e-mail. The message text itself is also variable. One example is: Your message (was not|could not be) delivered because the destination (computer|server) was (not|un)reachable within the allowed queue period. The amount of time a message is queued before it is returned depends on local configura-tion parameters (the text in brackets is variable). The name of the attached file that actually contains the worm is chosen at random and has one of the following extensions: ZIP, COM, SCR, EXE, PIF, BAT or CMD. If a user becomes infected by the worm, it creates a copy of itself under the name JAVA.EXE and searches for email addresses in the Windows address book, Internet temporary files, and in files on the computer with certain extensions. Once it has done this, it selects domain names from the addresses it has collected and uses them as search words in Google, Altavista, Yahoo and Lycos. Finally, Mydoom.AO sends itself out to all addresses it finds. The worm also creates several Windows registry entries to ensure it is run on every system start up. According to Luis Corrons, director of PandaLabs: "Virus creators are finding Internet search engines a powerful tool for rapidly spreading malicious code. Mydoom.N was the first to use this strategy, and this new worm is following in its footsteps. This tactic effectively multiplies the propagation capacity of a malicious code, and it is therefore likely that we will see more of the same". Given the likelihood of incidents involving Mydoom.AO, Panda Software advises users to act with caution and update their antivirus software. Panda Software clients already have the corresponding updates to detect and disinfect this new malicious code. Panda Software's clients can already access the updates for installing the new TruPreventTM Technologies along with their antivirus protection, providing a preventive layer of protection against new malicious code. For users with a different antivirus program installed, Panda TruPreventTM Personal is the perfect solution, as it is both compatible with and complements these products, providing a second layer of preventive protection that acts while the new virus is still being studied and the corresponding update is incorporated into traditional antivirus programs, decreasing the risk of infection. More information about TruPreventTM Technologies at http://www.pandasoftware.com/truprevent. In addition, users can scan their computers online for free with Panda ActiveScan, available at http://www.pandasoftware.com/ Users can also scan and disinfect their computers using Panda ActiveScan, the free, online scanner available from: www.pandasoftware.com More information about Mydoom.AO is available from Panda Software's Virus Encyclopedia, at http://www.pandasoftware.com/virus_info/encyclopedia/ NOTE: The addresses above may not show up on your screen as single lines. This would prevent you from using the links to access the web pages. If this happens, just use the 'cut' and 'paste' options to join the pieces of the URL. ------------------------------------------------------------ To unsubscribe from Virus Alerts, please visit: http://www.pandasoftware.com/unsubscribe.asp To contact with Panda Software, please visit: http://www.pandasoftware.com/about/contact/ ------------------------------------------------------------ Link to comment Share on other sites More sharing options...
Guest Scrapman53 Posted February 17, 2005 Report Share Posted February 17, 2005 Cheers Cunny. Link to comment Share on other sites More sharing options...
Flyinsi Posted February 18, 2005 Report Share Posted February 18, 2005 thanx cunny and death to all virus makers Link to comment Share on other sites More sharing options...
Recommended Posts