Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.
W32.Novarg.A@mm / W32/Mydoom@MM on the loose
Posted on 27-Jan-2004 11:54 | Filed under: News



Security firms are currently investigating a new mass-mailing worm. Initial submissions have been received with file extensions of .exe, .pif, .scr, and .zip. This virus tries to spread via email and by copying itself to the shared directory for Kazaa clients if they are present. The body of the message may contain the following variations:

  • The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.
  • The message contains Unicode characters and has been sent as a binary attachment.
  • Mail transaction failed. Partial message is available.

    The worm itself is encrypted, and security firms are still working on this. Some companies call it W32/Mydoom@MM and others W32.Novarg.A@mm.

    When this file is run it copies itself to the local system with the following filenames:

    c:\Program Files\KaZaA\My Shared Folder\activation_crack.scr
    %SysDir%\taskmon.exe
    (Where %Sysdir% is the Windows System directory, for example C:\WINDOWS\SYSTEM)

    It also uses a DLL that it creates in the Windows System directory:

    %SysDir%\shimgapi.dll (4,096 bytes)

    It creates the following registry entry to hook Windows startup:

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
    CurrentVersion\Run "TaskMon" = %SysDir%\taskmon.exe


    When the machine gets infected, the worm will set up a backdoor into the system by opening TCP ports 3127 thru 3198. This will potentially allow a hacker to connect to the machine and utilize it as a proxy to gain access to it's network resources. In addition, the backdoor has the ability to download and execute arbitrary files. The worm will perform a DoS starting on 1 February 2004.


  • More information: http://securityresponse.symantec.com/avcenter...







    Twitter and LinkedIn »



    Follow us to receive Twitter updates when new discussions are posted in our forums:



    Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



    Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:



    Trending now »

    Hot discussions in our forums right now:

    Get the Rugby World Cup for free when you join Spark or re-contract to selected Spark mobile or broadband plans
    Created by freitasm, last reply by ockel on 18-Jun-2019 20:28 (43 replies)
    Pages... 2 3


    Hydrogen powered cars: Your news and views please
    Created by frednz, last reply by Aredwood on 19-Jun-2019 01:24 (184 replies)
    Pages... 11 12 13


    Climate change: What can you do to help halt global warming and when will you do it?
    Created by frednz, last reply by tdgeek on 18-Jun-2019 12:12 (271 replies)
    Pages... 17 18 19


    Upgrade up to 3 years of Xbox Live to Ultimate Game Pass for $1
    Created by ShinyChrome, last reply by billgates on 18-Jun-2019 22:23 (15 replies)

    Goodbye ASB Virtual, ASB is now on Google Pay
    Created by scottjpalmer, last reply by NZLion on 18-Jun-2019 23:56 (11 replies)

    Change the SSD in an iMac
    Created by Geektastic, last reply by Geektastic on 18-Jun-2019 22:47 (23 replies)
    Pages... 2


    E-scooter share scheme launches in Wellington
    Created by freitasm, last reply by alasta on 18-Jun-2019 19:42 (23 replies)
    Pages... 2


    Jetstar new baggage policy- 7KG and not a gram more
    Created by geekbhaji, last reply by neb on 18-Jun-2019 19:36 (55 replies)
    Pages... 2 3 4