26-07-2004, 17:26
|
#1
|
|
Inactive
Join Date: Jun 2003
Location: I am house...
Services: $KY+HD - BT Infinity
Posts: 2,284
|
W32/Mydoom.o@MM
Beware this little virus is doing the rounds since today:
http://vil.nai.com/vil/content/v_127033.htm
I know a couple of large organisations that got hit...  
|
|
|
|
26-07-2004, 17:52
|
#2
|
|
In the corner, sulking.
Join Date: Jun 2003
Location: Shaw, Oldham, Lancashire.
Services: 2 TV 360 boxes. 500mb BB, Phone line.
Posts: 8,041
|
Re: W32/Mydoom.o@MM
Just had four e-mails which may have this, One "apparently" from ntlworld.com team, one from ntlworld.com support team, and on my Zen dial up account one fron zen.co.uk users support and one from DAEMON mail undeliverable.Glad I saw this warning because although ZA Pro quarantined the attachments I scanned them with my AV and it reported them as clean. 
With the exception of the mail that purported to be undeliverable the other three had this type of message.
" We have detected that your email account has been used to send a large amount of spam during the recent week.
Probably, your computer was compromised and now runs a trojan proxy server.
Please follow instructions in order to keep your computer safe.
Sincerely yours,
The ntlworld.com team "
|
|
|
|
|
26-07-2004, 18:03
|
#3
|
|
Inactive
Join Date: Jun 2003
Location: manchester
Age: 85
Posts: 553
|
Re: W32/Mydoom.o@MM
Quote:
|
Originally Posted by iadom
Just had four e-mails which may have this, One "apparently" from ntlworld.com team, one from ntlworld.com support team, and on my Zen dial up account one fron zen.co.uk users support and one from DAEMON mail undeliverable.Glad I saw this warning because although ZA Pro quarantined the attachments I scanned them with my AV and it reported them as clean.
With the exception of the mail that purported to be undeliverable the other three had this type of message.
" We have detected that your email account has been used to send a large amount of spam during the recent week.
Probably, your computer was compromised and now runs a trojan proxy server.
Please follow instructions in order to keep your computer safe.
Sincerely yours,
The ntlworld.com team " |
what av do u use?
|
|
|
|
|
26-07-2004, 18:11
|
#4
|
|
In the corner, sulking.
Join Date: Jun 2003
Location: Shaw, Oldham, Lancashire.
Services: 2 TV 360 boxes. 500mb BB, Phone line.
Posts: 8,041
|
Re: W32/Mydoom.o@MM
Quote:
|
Originally Posted by darkangel
what av do u use?
|
Command from Authentium, just as I was posting my AV software auto updated the deffiles so if I receive any more I will check it out. I just deleted the four previous ones, I had no intention of opening them.
|
|
|
|
|
26-07-2004, 18:24
|
#5
|
|
Permanently Banned
Join Date: Jun 2003
Location: norton , teesside
Age: 58
Posts: 10,571
|
Re: W32/Mydoom.o@MM
just updated avg manually , hopefully i will be ok 
|
|
|
|
|
26-07-2004, 18:44
|
#6
|
|
Inactive
Join Date: Jun 2003
Location: Essex
Age: 38
Services: Sky multiroom (Sky Q)
Sky Fibre Unlimited
Sky Landline
Posts: 8,851
|
Re: W32/Mydoom.o@MM
I have just updated Norton AV using the Intelligent Updater. Hopefully i will be safe.
|
|
|
|
|
26-07-2004, 18:59
|
#7
|
|
Inactive
Join Date: Oct 2003
Location: 2nd CPU to the right & past the cache
Posts: 1,949
|
Re: W32/Mydoom.o@MM
Quote:
|
Originally Posted by paulyoung666
just updated avg manually , hopefully i will be ok |
AVG 7.0 - AVI 263.4.9 and AVG 6.0 - 727
Added detection of new variants of I-Worm/Mydoom.O, I-Worm/Lovgate, I-Worm/Redrac.
- July 26, 2004 -
|
|
|
|
|
26-07-2004, 18:59
|
#8
|
|
Permanently Banned
Join Date: Jun 2003
Location: norton , teesside
Age: 58
Posts: 10,571
|
Re: W32/Mydoom.o@MM
Quote:
|
Originally Posted by MetaWraith
|
phew 
|
|
|
|
|
26-07-2004, 19:01
|
#9
|
|
Inactive
Join Date: Oct 2003
Location: 2nd CPU to the right & past the cache
Posts: 1,949
|
Re: W32/Mydoom.o@MM
IMHO This page is more readable than the corresponding McAfee one.
http://www.f-secure.com/v-descs/mydoom_m.shtml
|
|
|
|
|
26-07-2004, 19:11
|
#10
|
|
Inactive
Join Date: Oct 2003
Location: 2nd CPU to the right & past the cache
Posts: 1,949
|
Re: W32/Mydoom.o@MM
btw
I believe that since port 1034 is allocated to "activesync notifications" then anybody not using MS Active Directory should suffer no ill effects from blocking that port by way of extra protection.
|
|
|
|
|
26-07-2004, 20:30
|
#11
|
|
Guest
Location: Cambridge
Posts: n/a
|
Re: W32/Mydoom.o@MM
Quote:
|
Originally Posted by Tricky
|
Yep, this is one
|
|
|
|
|
27-07-2004, 08:53
|
#12
|
|
Inactive
Join Date: Oct 2003
Location: 2nd CPU to the right & past the cache
Posts: 1,949
|
Re: W32/Mydoom.o@MM
|
|
|
|
|
27-07-2004, 11:16
|
#13
|
|
In the corner, sulking.
Join Date: Jun 2003
Location: Shaw, Oldham, Lancashire.
Services: 2 TV 360 boxes. 500mb BB, Phone line.
Posts: 8,041
|
Re: W32/Mydoom.o@MM
Had another one this morning, headers reveal same IP in the [received from] field as the 4 from yesterday.
AV scan of attachment confirmed and disinfected W32/mydoom.O@mm. 
|
|
|
|
Posting Rules
|
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
HTML code is Off
|
|
|
All times are GMT. The time now is 14:44.
|
Join CF
You are here: 
