[FARC] Virus Alert!
Charles " Doc " Brown
[email protected]
Tue, 27 Jan 2004 12:03:26 -0500
Importance: High
Virus Alert!
Win32.Mydoom.A is a worm spreading via e-mail.=20
If you see an E-mail with any of the below characteristics, delete it =
from your Inbox and from the Deleted Items folders.
Do not open an email with the subject of:
Error
hello
HELLO
hi
Hi
Mail Delivery System
Mail Transaction Failed
Server Report
Status=20
The Message Body may be in the list below, empty, or consist of =
randomly-generated, illegible garbage. An example of a Message Body used =
by the worm:
The message contains Unicode characters and has been sent as a binary =
attachment.=20
The message cannot be represented in 7-bit ASCII encoding and has been =
sent as a binary attachment.=20
Mail transaction failed. Partial message is available.=20
The Attachment name is chosen from a list carried by the worm, or may =
consist of randomly-generated characters. Examples of attachment names =
used by the worm:
Data
Readme
Message
Body
Text
file
doc
document=20
Attachments also use a variable extension. Extensions used by the worm =
for its attachment include .bat, .cmd, .pif, .exe, and .scr. The worm =
may also send itself as a .ZIP archive.
When performing its mass-mailing routine, the worm finds destination =
e-mail addresses by searching files with the following extensions:
adb
asp
dbx
htm
php
sht
tbb
txt
wab
Possible extensions are:
bat
exe
pif
scr=20
--- StripMime Report -- processed MIME parts ---
multipart/alternative
text/plain (text body -- kept)
text/html
The reason this message is shown is because the post was in HTML
or had an attachment. Attachments are not allowed. To learn how
to post in Plain-Text go to: http://www.expita.com/nomime.html ---