Latest Email worm has SCO-facing payload
Novarg / MyDoom declared critical
Posted in Anti-Virus, 27th January 2004 03:22 GMT
Free whitepaper – Securing your Microsoft Internet Information Services (MS IIS) web server
Going by the name of 'Novarg' or 'MyDoom', the latest mass-mailing worm to infest your in-tray is spreading at the same rate as SoBig, according to the anti-virus industry.
The worm also targets the SCO Group's corporate website, according to a Symantec alert. On Windows PCs, the worm creates 64 threads which will hit www.sco.com with GET requests, between February 1 and 12. It also copies itself to KaZaA's download directory, masquerading as a software executable: names include icq2004-final and winamp5.
Windows users should check for a file named shimgapi.dll in the system directory, and update their AV software.
For most users the major inconvenience will be the bandwidth consumed: the executable attachment is 22kb in size. For SCO, it represents a different problem. When the Blaster worm was primed to attack Microsoft's Windows Update servers, the company shut down for the duration of the attempted denial of service. ®
Related Stories
Blaster rewrites Windows worm rules [full coverage]
Sobig-F is dead
And now we are One. Many unhappy returns to SoBig
Sobig-F blamed for massive increase in spam
Sobig beats Blaster in Top of the Viral Pops
Sobig-F is fastest growing virus ever - official
Yahoo! variant! of! Microsoft! support! worm! spreading! rapidly!
Heavy squalls of blended worms to hit next year
Free whitepaper – The shortcut guide to managing certificate lifecycles


Airport insecurity: the case of lost laptops
Avoiding 7 common mistakes of IT security compliance
Securing your Microsoft Internet Information Services (MS IIS) web server
The mandate for application security
Google cloud told to encrypt itself
Chinese firm hits back at cyberspy claims
BlockMaster SafeStick hardware-encrypted USB drive