Novarg Virus
Some information about a recent virus that is being heavily passed around the net at this time:
From: May be a spoofed from address
Subject:
(One of the following) test hi hello
Mail Delivery System
Mail Transaction Failed
Server Report
Status
Error
Message:
(One of the following)
Mail transaction failed. Partial message is available.
The message contains Unicode characters and has been sent as a binary attachment.
The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment. test
Attachment:
(One of the following) document readme doc text file data test message body
--------------------------------------------------------------------------------
Notes:
The attachment may have two suffixes. If so, the first suffix will be one of the following:
.htm
.txt
.doc
The worm will always end with one of the following suffixes:
.pif
.scr
.exe
.cmd
.bat
.zip (This is an actual .zip file that contains a copy of the worm, sharing the same file name as the .zip. For example, readme.zip can contain readme.exe.)
If the worm has an extension of .exe or .scr, the file will be displayed with the following icon; otherwise it will use the icon appropriate to the corresponding file type.
--------------------------------------------------------------------------------
9. Copies itself to the Kazaa download folder as one of the following files:
Winamp5 icq2004-final activation_crack strip-girl-2.0bdcom_patches rootkitXP office_crack nuke2004
With a file extension of:
.pif
.scr
.bat
.exe
https://securityresponse.symantec.com/avcen… ovarg.a@mm.htmlI have been receiving several hundred of these daily since Tuesday at my office. Our antivirus system is preventing us from becoming infected, but the mass circulation of this virus is bogging down the internet. You should update your antivirus definition files and check your PC for viruses to be sure you don't have it. Until people begin to clean up their systems, we are all likely to see a slow down in 'net' performance.