New Version of MyDoom Spreading on InternetNovember 10, 2004

Time: November 10, 2004
Location:
Audience:Campus
Category:
Attendancenone
Description
A new version of the MyDoom mass mailing virus is spreading on the internet and here at Gutstauvs.

The virus arrives as an email and asks the user to visit a web link. The web link is infected and causes the machine to become infected. Once infected it begins to mass mail others.

The text of the message is typically:
Congratulations! PayPal has successfully charged $175 to your credit card. Your order tracking number is A866DEC0, and your item will be shipped within three business days.
or
Hi! I am looking for new friends. I am from Miami, FL. You can see my homepage with my last webcam photos here.

Once infected the removal process is similar to other viruses -
  • Turn off System Restore
  • Safe mode scan with defs that are 11/8 or later
  • Reverse registry changes
For complete details, please see the Symantec or CNN write up.
ContactTami Aune