[FARC] Virus Alert!

Charles " Doc " Brown [email protected]
Tue, 27 Jan 2004 12:03:26 -0500



Importance: High


Virus Alert!



Win32.Mydoom.A is a worm spreading via e-mail.=20

If you see an E-mail with any of the below characteristics, delete it =
from your Inbox and from the Deleted Items folders.

Do not open an email with the subject of:

Error
hello
HELLO
hi
Hi
Mail Delivery System
Mail Transaction Failed
Server Report
Status=20

The Message Body may be in the list below, empty, or consist of =
randomly-generated, illegible garbage. An example of a Message Body used =
by the worm:

The message contains Unicode characters and has been sent as a binary =
attachment.=20

The message cannot be represented in 7-bit ASCII encoding and has been =
sent as a binary attachment.=20

Mail transaction failed. Partial message is available.=20

The Attachment name is chosen from a list carried by the worm, or may =
consist of randomly-generated characters. Examples of attachment names =
used by the worm:

Data
Readme
Message
Body
Text
file
doc
document=20

Attachments also use a variable extension. Extensions used by the worm =
for its attachment include .bat, .cmd, .pif, .exe, and .scr. The worm =
may also send itself as a .ZIP archive.

When performing its mass-mailing routine, the worm finds destination =
e-mail addresses by searching files with the following extensions:

adb
asp
dbx
htm
php
sht
tbb
txt
wab

Possible extensions are:

bat
exe
pif
scr=20





--- StripMime Report -- processed MIME parts ---
multipart/alternative
  text/plain (text body -- kept)
  text/html
The reason this message is shown is because the post was in HTML
or had an attachment.  Attachments are not allowed.  To learn how
to post in Plain-Text go to: http://www.expita.com/nomime.html  ---