Saturday, January 31, 2004

Since January 26, I kept receiving Virus Alert from my mail server. Not only that, volumes of Undelivered Mail or Returned Mail from Daemon was also sent into my inbox! I refrained from chatting to ensure that others might not get infected from my computer. Only to find out from Afonso that he received couple of mails also in his INBOX with the same subject line.

The virus is using my own e-mail address to make it appear that the mail was undelivered to the recipient and had been returned to me. But, I know it was not a legitimate e-mail from me because there was no name on it except e-mail address and the recipient's name was not known to me either. Here is the sample mail I received:

Symantec AntiVirus found a virus in an attachment your mail sent to Bob Kirsh.

To ensure the recipient(s) are able to use the files you sent, perform a virus scan on your computer, clean any infected files, then resend this attachment.

Attachment: readme.zip
Virus name: W32.Novarg.A@mm
Action taken: Quarantine succeeded :
File status: Infected

My mail server alerted me and deleted viruses like WORM_MIMAIL.R, and WORM_MYDOOM.A in my mail traffic. Based on Computerworld Report: "The Mydoom worm, also known as Novarg and Mimail.R, is a mass-mailing worm that arrives via e-mail as an attachment with one of several possible file extensions, including .bat, .cmd, .exe, .pif, .scr or .zip. When a user opens the attachment, his computer becomes infected. The worm is apparently designed to attack the SCO's Web site, beginning on Feb. 1." Therefore, SCO offers $250,000 reward for arrest of Mydoom worm author OR "for information leading to the arrest and conviction of the individual or individuals responsible for creating the Mydoom virus."

Also, Computer World reported that "Experts have said that the Mydoom worm is spreading faster than last year's Sobig.F, which topped the charts as the most widespread e-mail worm of 2003."

• ISPs and corporations have been bogged down by a crush of infected e-mails as Mydoom worm spreads
• Symantec: W32.Novarg.A@mm is a Category 4 mass-mailing worm which arrives with a .bat, .cmd, .exe, .pif, .scr, or .zip attachment.

I already set my my pop mail preference to view mails in attachment format from previous inline attachment. Please observe all possible precautions so that your computer will not be infected with this virus. It already caused us so much inconvenience scanning our PC from harmful viruses but we found nothing. Glad my ISP is updated with virus definitions.

W32/MyDoom-A and W32/MyDoom-B can be removed from Windows 95/98/Me and Windows NT/2000/XP/2003 computers automatically with MYDOOGUI, a disinfector for standalone Windows computers...