Eclectic Echoes

CERT® Incident Note IN-2004-01: W32/Novarg.A Virus

Overview

The CERT/CC ® has been receiving reports of a new mass-mailing virus known as W32/Novarg.A, W32/Shimg, or W32/Mydoom that has been reported to open a backdoor to the compromised system and possibly launch a denial-of-service attack against a web site at a fixed time in the future.

Description

The virus arrives as an email message with a 22,528-byte attachment that has a random filename with a file extension of .cmd, .pif, .scr, .exe, or .bat. The attachment may also arrive as a ZIP archive.

Some messages containing the virus have had the following characteristics:

    Subject: <random>
    From: <spoofed>
    To: <email address>

    Body:
    (The body has been reported to contain one of the following three messages.)

    "The message cannot be represented in 7-bit ASCII encoding and has been 
     sent as a binary attachment."

    "The message contains Unicode characters and has been sent as a binary 
     attachment."

    "Mail transaction failed. Partial message is available."

In addition to the backdoor capabilities, the virus is also believed to have the capability to launch a distributed denial-of-service attack against a specific web site beginning on February 1, 2004. As with other malicious code having mass-mailing capabilities, W32/Novarg.A may cause “collateral” denial-of-service conditions in networks where either (a) multiple systems are infected, or (b) large volumes of infected mail are received.

Another one out in the wild…
For more information – not much more is available right now – check in with CERT/CC’s Incident IN-2004-01 page, which has links to updated virus database’s for the major AV packages out there. They also have the normal recommendations (which still go unheeded!) for limiting exposure.

So everyone be sure to keep your digital prophylactics fresh and ready.