***ATTENTION VIRUS ALERT***
A new virus worm known as W32/Mydoom@MM (McAfee and Innoculan), W32.Novarg.A@MM (Symantec) has been quickly spreading across the internet. This virus is a mass-mailing worm that arrives as an attachment with the file extension .bat, .cmd, .exe, .pif, .scr, or .zip. If you execute these attachments they will create backdoors and further propagate the virus. In addition, the backdoor has the ability to download and execute arbitrary files. Please do not open or execute any unexpected file attachments from unknown sources.
As always, if you have a questions about the safety or validity of any message you receive, please contact the IT Help Desk before opening any unfamiliar attachments. Also, please verify that the anti-virus software on your systems is functioning correctly and has the most recent signature update. If you require assistance please contact the IT Help Desk.
An example of the email containing the virus will look similar to the following:
From: may be a spoofed from address
Subject:
(one of the following)
test
hi
hello
Mail Delivery System
Mail Transaction Failed
Server Report
Status
Error
Message:
(one of the following)
Mail transaction failed. Partial message is available.
The message contains Unicode characters and has been sent as a binary attachment.
The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.
Attachment:
(one of the following)
document
readme
doc
text
file
data
test
message
body
Notes:
The attachment may have two suffixes. If so, the first suffix will be one of the following:
.htm
.txt
.doc
The worm will always end with one of the following suffixes:
.pif
.scr
.exe
.cmd
.bat
.zip
The icon displayed will look like the following:
unless the worm has .exe or .scr for an extension, in which case the file will use the following icon:
For more information on the W32.Novarg.A@mm visit:
http://www.sarc.com/avcenter/venc/da...varg.a@mm.html
Thank you for your attention,
IT Operations