Since the W32/MyDoom mass-mailing virus first appeared on the Internet, US-CERT continues to see new variants appearing and many variants (new and old) continuing to spread. Many variants of W32/MyDoom are known to open a backdoor and use their own SMTP engine to spread through email. This virus has also been identified as W32/Bofra by some vendors.
Recent reports to US-CERT indicate that the W32/MyDoom variants propagate and communicate on TCP ports 1639, 1640, and 6667. The variants discovered on November 8th and 9th of 2004 may attempt to exploit an IFRAME vulnerability in Microsoft Internet Explorer, described in VU#842160. These variants may arrive as an email message with the following characteristics:
* Spoofed From address
* A Subject line containing one of the following:
o Hi!
o
o
o Confirmation
o funny photos :)
o hello
o hey!
* Body text containing a URL that leads to a malicious site.
Upon clicking on the URL, the user will visit a web page that attempts to exploit VU#842160. There is a patch available to address this vulnerability. For more information about this patch, please refer to the "Solution" section of VU#842160.
As a general rule, US-CERT recommends filtering all types of network traffic that are not required for normal operation by using a firewall, IPsec policies, or similar technology. If this is impractical, sites should consider blocking both inbound and outbound traffic to the ports listed above at both the host and network level, depending on network requirements.
If access cannot be blocked for all external hosts, US-CERT recommends limiting access to only those hosts that require it for normal operation.
Additionally, US-CERT strongly encourages users not to follow unknown links, even if sent by a known and trusted source. Users are encouraged to install and maintain anti-virus software and exercise caution when handling attachments. Anti-virus software may not be able to scan password protected archive files, so users must use discretion when opening archive files and should scan files once extracted from an archive.
You may also wish to visit the US-CERT's Computer Virus Resources page for additional information.
[ Comment, Edit or Article Submission ]
