PDA

View Full Version : Virus Information



Speed Racer
01-29-2004, 01:46 PM
Hello everyone,

For those of you who don't already know, here is a bit more information on the MYDOOM Email Virus. It's spreading rapidly and creating quite a mess. You might want to take a moment and visit some of the following sites for information about the virus, and how to deal with it:

Article about what the virus is and what it's doing:
http://www.infoworld.com/article/04/01/27/HNdoomworm_1.html

Information from McAfee Security:
http://us.mcafee.com/virusInfo/default.asp?id=helpCenter&hcName=mydoom&cid=9547

Information from Symantec (Norton Anti Virus):
http://securityresponse.symantec.com/avcenter/venc/data/w32.novarg.a@mm.html

If you find that you have the virus, or suspect that you do, please use the following removal tool from Symantec:

1. Download the FxNovarg.exe file from: http://securityresponse.symantec.com/avcenter/FxNovarg.exe
2. Save the file to a convenient location, such as your downloads folder or the Windows desktop, or removable media known to be uninfected.
3. To check the authenticity of the digital signature, refer to the "Digital signature" section of the Symantec site about the virus.
4. Close all the running programs before running the tool.
5. If you are on a network, or if you have a full-time connection to the Internet, disconnect the computer from the network and the Internet.
6. If you are running Windows Me or XP, then disable System Restore. Refer to the "System Restore option in Windows Me/XP" section later in this writeup for further details. http://securityresponse.symantec.com/avcenter/venc/data/w32.novarg.a@mm.removal.tool.html
7. Double-click the FxNovarg.exe file to start the removal tool.
8. Click Start to begin the process, and then allow the tool to run.
9. Restart the computer.
10. Run the removal tool again to ensure that the system is clean.
11. If you are running Windows Me/XP, then reenable System Restore.
12. If you are using Active Desktop, you may need to restore it.
13. Run LiveUpdate to make sure that you are using the most current virus definitions.

Most of all, make sure whatever anti-virus program you're using has the latest definitions installed. You might want to pass this infol along to other people on your email list as well.

Best of luck...

Stephen

ma61_turbo
01-30-2004, 08:29 PM
Hello everyone,

For those of you who don't already know, here is a bit more information on the MYDOOM Email Virus. It's spreading rapidly and creating quite a mess. You might want to take a moment and visit some of the following sites for information about the virus, and how to deal with it:

Article about what the virus is and what it's doing:
http://www.infoworld.com/article/04/01/27/HNdoomworm_1.html

Information from McAfee Security:
http://us.mcafee.com/virusInfo/default.asp?id=helpCenter&hcName=mydoom&cid=9547

Information from Symantec (Norton Anti Virus):
http://securityresponse.symantec.com/avcenter/venc/data/w32.novarg.a@mm.html

If you find that you have the virus, or suspect that you do, please use the following removal tool from Symantec:

1. Download the FxNovarg.exe file from: http://securityresponse.symantec.com/avcenter/FxNovarg.exe
2. Save the file to a convenient location, such as your downloads folder or the Windows desktop, or removable media known to be uninfected.
3. To check the authenticity of the digital signature, refer to the "Digital signature" section of the Symantec site about the virus.
4. Close all the running programs before running the tool.
5. If you are on a network, or if you have a full-time connection to the Internet, disconnect the computer from the network and the Internet.
6. If you are running Windows Me or XP, then disable System Restore. Refer to the "System Restore option in Windows Me/XP" section later in this writeup for further details. http://securityresponse.symantec.com/avcenter/venc/data/w32.novarg.a@mm.removal.tool.html
7. Double-click the FxNovarg.exe file to start the removal tool.
8. Click Start to begin the process, and then allow the tool to run.
9. Restart the computer.
10. Run the removal tool again to ensure that the system is clean.
11. If you are running Windows Me/XP, then reenable System Restore.
12. If you are using Active Desktop, you may need to restore it.
13. Run LiveUpdate to make sure that you are using the most current virus definitions.

Most of all, make sure whatever anti-virus program you're using has the latest definitions installed. You might want to pass this infol along to other people on your email list as well.

Best of luck...

Stephen

Also be aware that there is a MyDoom.B version out already. This edits the hosts file on your pc to prevent access to the following websites:

ad.doubleclick.net
ad.fastclick.net
ads.fastclick.net
ar.atwola.com
atdmt.com
avp.ch
avp.com
avp.ru
awaps.net
banner.fastclick.net
banners.fastclick.net
ca.com
click.atdmt.com
clicks.atdmt.com
dispatch.mcafee.com
download.mcafee.com
download.microsoft.com
downloads.microsoft.com
engine.awaps.net
fastclick.net
f-secure.com
ftp.f-secure.com
ftp.sophos.com
go.microsoft.com
liveupdate.symantec.com
mast.mcafee.com
mcafee.com
media.fastclick.net
msdn.microsoft.com
my-etrust.com
nai.com
networkassociates.com
office.microsoft.com
phx.corporate-ir.net
secure.nai.com
securityresponse.symantec.com
service1.symantec.com
sophos.com
spd.atdmt.com
support.microsoft.com
symantec.com
update.symantec.com
updates.symantec.com
us.mcafee.com
vil.nai.com
viruslist.ru
windowsupdate.microsoft.com
www.avp.ch
www.avp.com
www.avp.ru
www.awaps.net
www.ca.com
www.fastclick.net
www.f-secure.com
www.kaspersky.ru
www.mcafee.com
www.microsoft.com
www.my-etrust.com
www.nai.com
www.networkassociates.com
www.sophos.com
www.symantec.com
www.trendmicro.com
www.viruslist.ru
www3.ca.com

Crash
01-31-2004, 10:00 PM
Hm... most of the sites that are in the B version I already have blocked... Perhaps I myself am infected... J/k, thanks for the info, I'll be on the lookout

Racefiend
02-03-2004, 08:13 PM
Also be aware of a worm which comes as an email from paypal.com telling you your account will expire in 5 days. It has an .scr attachment which you're supposed to enter your personal CC info on. DELETE IT!

zank
02-03-2004, 09:41 PM
Also be aware of a worm which comes as an email from paypal.com telling you your account will expire in 5 days. It has an .scr attachment which you're supposed to enter your personal CC info on. DELETE IT!

:shock: I got that the other day, I deleted it anyway :twisted: