New MyDoom Strain Targets RIAA

[elektro80]

New MyDoom Strain Targets Record Industry Group RIAA

Today, Global Hauri assigned a medium risk to a new, fast spreading variant of MyDoom, a.k.a. MyDoomf. The new variant of the MyDoom worm is spreading through e-mail attachments and P2P file-sharing networks it randomly changes senders' ("spoofs") names and modifies the registry of infected computers. The new worm is designed to perform a DoS attack, this time targeting the Recording Industry Association of America www.RIAA.com.

MyDoom.f, a direct code copy of a previous MyDoom variant, shows up as a short message with an attached file that pretends to be a Zip archive. It is a destructive worm with its own SMTP engine and spreads via email by mailing itself to addresses found on the victim's machine.


"Despite the recent wave of viruses, email users still like to trust emails they apparently receive from a friend or colleague. We recommend users taking the habit of writing very precise subject lines. That makes it easier to distinguish between virus mails and real mails and also avoids deleting good email," said Global Hauri's CEO, Mr. Eric Kwon. "Just make sure your antivirus solution is updated with the latest definitions and set to repair automatically, then this 'My.Doom' should not be a problem."

Emails users should be prepared to receive virus mails, spoofing the email
address of a friend or colleague. Emails with the following subject line
should be immediately deleted:

- Re: Approved
- Attention
- Your request is being processed
- (Blank)
- Please read
- Re: Thank You
- Recent news
- IMPORTANT
- Please reply
- Read this
- Your credit card
- Unknown
- EXPIRED ACCOUNT
- Your request was registered
- automatic responder
- Recent news
- Readme
- Bug
- You have 1 day left
- ApprovedNews
- Read it immediately
- Announcement
- =P Announcement
- hi, it's me
- You use illegal File Sharing... Your IP was logged
- Your account is about to be expired
- Love is Love is...
- Undeliverable message
- Re:
- Your order was registered
- Your order is being processed
- Current Status
- read now!
- Something for you
- For your information
- Information Warning
- hello
- hi

And attachment: (Varies [.cmd, .bat, .pif, .com, .scr, .exe] -- often
arrives in a zip archive) (34,686 bytes)

- paypal.zip
- creditcard.bat
- creditcard.zip
- website.zip
- textfile.zip
- photo.zip
- part1.zip
- notes.zip
- mail.zip
- vpf.zip
- details.zip






http://mi2n.com/press.php3?press_nb=63221