Mass Mailing Worm: myDoom or NORVAG

[DK64_MASTER]

Don't open any emails with subjects of this nature.

It can confuse us hear especially, since our formum is called Doom9.

If you subscribe to the topics, make sure you actually read the subject line, and don't assume it since it says Doom, it's from here.

Just a friendly heads up to all aware users!!

I'm probably going to get email from replies of this topic.

Cheers!! :sly:

DK64_MASTER

[Sirber]

no such problem with webmails :D

[Wilbert]

from RAV-AntiVirus:


Depending on the current time, the Win32/Mydoom.A@mm will try to initiate a DoS attack to www.sco.com by sending at regular time intervals HTTP GET requests from up to 63 threads simultaneous. Also, depending on the current system time the worm will not spread any more.

:-)

[ultimatebilly]

Anybody who can send this mail to me?? :D

[mf]

I want to be infected for a change! /me goes to sniff in his bulk mail folder... Crap! Emptied it this morning... :(

[communist]

For once in a while a usefull virus :D

[Swede]

Some are getting more hits than others. I'm hosting nic (amongst others) and so far TODAY he's got 127.476 eMails... My server can still cope with this load but if this continues (or someone else here starts getting the same load) I will have to shut down my mailserver... :(

[mf]

Originally posted on timesonline.co.uk (http://www.timesonline.co.uk/article/0,,1-979473,00.html)
Besides sending out tainted e-mail, the program appears to open up a backdoor so hackers can take over the computer later.

Symantec said the worm appeared to contain a program that logs keystrokes on infected machines. It could collect username and passwords of unsuspecting users and distribute them to strangers.

Guess I won't get infected after all. :rolleyes: dDoSing SCO is fine, but a security hole and keylogger? No thanks ;).

[Swede]

On a more serious note: I WISH every mailserver-admin would STOP sending a 'You've sent a virus' to the Reply-to-header since that person (at least in 99.99% of the cases) is NOT the one that sent the virus in the first place.

This SIMPLE rule would lower the load of every mailserver in the world at least 95%. Or at least STOP the stupid return of the entire mail as that thing alone increases traffic at least ten times!

(BTW, the amount of eMails recieved is now 137.532)

[ookzDVD]

To be honest,
I've never been infected by email worm virus from the day I was born
until today!!!
Trust me, "careful" is the most effective way to avoid this stupid worm!
I can conclude that only stupid people will be infected by stupid worm! LOL!

[Doom9]

Trust me, "careful" is the most effective way to avoid this stupid worm!
I can conclude that only stupid people will be infected by stupid worm! LOL!Very much true.. I wish I could be so frank but a large audience also means a lot of people to potentially insult/piss off.

Not even a semi-private address helped this time. I also got a few of those mails at work and that address isn't widely known either.

[mf]

Originally posted by Doom9
Not even a semi-private address helped this time. I also got a few of those mails at work and that address isn't widely known either.
Heh, I was logged in at my shell the other day and it said "You have mail". So I fire up pine, and see like 20 spam mails. Now this is at an address I didn't even know existed (I knew I should have a mailbox on that shell, but didn't know the address, and didn't care either)! Weird things happen. Didn't get a mydoom on there though.

[JimiK]

Talking about weird things: as you know, the adress of the sender is faked. Now I have a mailaccount at the german provider GMX. You get two adresses (I'll call them "myadress1/2") for one account. Two days ago I got a mail from "myadress1" to "myadress2"! How the hell can this happen? How does one know that these two adresses belong to one account?
The other interesting this is that you get failure notices for mails you never sent. Strange world.
Best regards,
JimiK

[mf]

Originally posted by JimiK
Two days ago I got a mail from "myadress1" to "myadress2"! How the hell can this happen? How does one know that these two adresses belong to one account?
Pure coincidence. Your "myaddress1" is probably sent as sender-address in spam mails to many other email addresses as well.

[mpucoder]

Have you guys heard of finger? It's an old protocol devised in the days when the internet was small (and better behaved) to help people contact each other. It gives out the email addresses of everybody known to an email server, if enabled. There are lots of clients out there if you want to test your own email host (I use NetInfo by Alexander Tsarfin). You can finger one email address, or, by leaving the name blank (as in @mpucoder.com), try to get a list of users.

[AudioVideoMaster]

Originally posted by Swede
On a more serious note: I WISH every mailserver-admin would STOP sending a 'You've sent a virus' to the Reply-to-header since that person (at least in 99.99% of the cases) is NOT the one that sent the virus in the first place.


I totally agree! My public and catchall webmail accounts are packed full of those darn messages along with original emails with the worm ZIP file attachments.

I can always tell it's the same one, just with a different subject heading, because the entire email is exactly 31KB is size always.

"Delete" is my friend. :D

[DDogg]

This link to the stinger removal tool may save a little time for some of the folks reading the thread.
http://vil.nai.com/vil/stinger/ as well as this informational one - http://vil.nai.com/vil/content/v_100983.htm

[ChristianHJW]

I could throw up because of this shit meanwhile. I am moderating 16 mailing lists as of today, i guess you all can imagine what this means for me, since this stupid worm is out :( ....

[trbarry]

I totally agree! My public and catchall webmail accounts are packed full of those darn messages along with original emails with the worm ZIP file attachments.

Anymore I keep 2 separate junk folders for my various mail filters to deal with. One is traditional junk mail, in case I need to find a good deal on Viagra, Valium, getting rich quick, or young teens that like farm animals.

But the second and newer one is for the various messages about undeliverable mail, viruses, and helpful warnings from some system administrator overseas. Recently the crap ratio is more than 5 to 1 in favor of this second folder. They seriously need to turn this stuff off.

I've been getting 1-2000 messages a day for the past few days.

- Tom

[Fredledingue]

"If you subscribe to the topics, make sure you actually read the subject line, and don't assume it since it says Doom, it's from here."

Are you sure? There is no more anti-M$ and anti-corporate than Doom9... :D :D

__________________________

I'm not using junk folder but a junk address/
I have a private adress for job, friends, family etc,

All the junk (internet subscription, forums, pronsites etc) I let it to Yahoo!-mail to deal with it! :) :devil:

[Suman]

I use Popfile (http://popfile.sourceforge.net/) its a Bayesian based email filter software which does a very good job in classifying most of worms like Mydoom, Sobig etc. You can train Popfile to quarantine messages in a way such that scripts don't run unannounced in OE or Outlook.

[DK64_MASTER]

ROFL @ Fredledingue

I too hate M$ since they gave me ME on one of my computers.

Has the outbreak subsided yet?

I must be one of the few people who didn't recieve a MyDoom email, but albeit, my sister did.

[jonny]

Originally posted by Swede
(BTW, the amount of eMails recieved is now 137.532)
:scared:
the worst thing is that i think this will not stop (sometime i check my old msn email account: it is always filled, and takes 20 mins to fill again if i trash viruses)

[Swede]

It will prolly take some time before it stops but at least it looks like it's slowing down.
Jan 29: ~230.000; Jan 30: ~215.000; Feb 1: ~208.000; and so far today ~76.000 (indicating something like 130.000).

These numbers are including 'You've sent a virus'-emails. How I wish I could close down those mailservers :devil: !!

[jonny]

A funny note, e-mail notifications from this thread gets blocked too :)

[mpucoder]

I though this worm had died out, but the number of emails is once again increasing. Seems either more of the infected machines are at places of work, or more people shut their computers off for the Super Bowl than I thought.

[Soulhunter]

Got 11 myDoom mails, till now... :eek:

Bye

[mf]

Originally posted by Soulhunter
Got 11 myDoom mails, till now... :eek:

Bye
Nothing that reached further than my Bulk Mail folder, which I manually scan for mails I recognize as non-bulk. :)

[Belgabor]

Originally posted by JimiK
Talking about weird things: as you know, the adress of the sender is faked. Now I have a mailaccount at the german provider GMX. You get two adresses (I'll call them "myadress1/2") for one account. Two days ago I got a mail from "myadress1" to "myadress2"! How the hell can this happen? How does one know that these two adresses belong to one account?
The other interesting this is that you get failure notices for mails you never sent. Strange world.
Best regards,
JimiK
He, I'm better. My gmx address sent it to itself (at least according to the header) :p

[AudioVideoMaster]

Originally posted by jonny
A funny note, e-mail notifications from this thread gets blocked too :)

Yeah I just noticed that too when I only got one topic reply notification for this thread instead of many like I usually get.


But I'm still getting about 10-20 of the same 31KB zip files long with those darn mailserver return-to-sender auto-replies a day. Thankfully it seems to be getting under control some what.