New Mydoom Variation

FYI…from the ISC:

- http://isc.sans.org/diary.php?date=2005-02-16
Updated February 17th 2005 05:01 UTC
"It has been reported that a new variation of MyDoom has been spreading on the Internet tonight. Like many of the previous variations of the MyDoom virus, the email appears to come from the ISP of the recipient and contains an executable or zipped attachment. Below is an example of the body

Dear user ,

Your email account has been used to send a huge amount of unsolicited
commercial email messages during this week. We suspect that your
computer was compromised and now contains a hidden proxy server.

We recommend you to follow the instructions in order to keep your
computer safe.

Have a nice day,
support team.

For more information on this variation, please see:
http://secunia.com/virus_information/15463/mydoom.bb/
http://vil.nai.com/vil/content/v_131856.htm
http://www.trendmicro.com/vinfo/virusencyc…=WORM_MYDOOM.BB
http://www.sarc.com/avcenter/venc/data/[removed]
http://www.sophos.com/virusinfo/analyses/w32mydoomo.html …"

W32.Mydoom@mm Removal Tool
- http://securityresponse.symantec.com/avcen…moval.tool.html
Revision History:
* February 17, 2005: Version 1.5.1 released to support W32.Mydoom.AX@mm

FYI…

- http://isc.sans.org/diary.php?date=2005-02-19
Updated February 20th 2005 16:07 UTC
"MyDoom BC and BD
Two more versions of the Mydoom worm, dubbed Mydoom.BC and .BD, are on the loose. AV detection was spurious at first, but since we got a sample early on, we were able to help the process along by submitting it to the vendors. Additional investigation revealed that the new version was downloading a file called "contraste.jpg" from a web site in France. The JPG isn't really a JPG, but rather a backdoor component named Nemog.D
- http://securityresponse.symantec.com/avcen…or.nemog.d.html

… or BackDoor-CEB.f
- http://vil.mcafeesecurity.com/vil/content/v_131340.htm
…depending on which AV vendor you ask. The owner of the site in France, as well as the owners of five more sites hosting the same backdoor, were contacted during the day…"

W32.Mydoom@mm Removal Tool
- http://securityresponse.symantec.com/avcen…moval.tool.html
Revision History:
* February 21, 2005: Version 1.7.0 released…