# MA-064.012004: MyCERT Alert - W32.Novarg.A@mm

**Date:** 28 Jan 2004  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-064.012004  
**Advisory ID:** MA-064.012004

---

Brief Description
MyCERT received information from various anti-virus vendors and CERTs communities around the world regarding the wild spread of a newly discovered worm, the W32.Novarg.A@mm. This mass-mailing worm is also known as 32/Mydoom@MM, WORM-MIMAIL.R which was first discovered on 26, 2004 1:47 PM (US Pacific Time).
Systems that are prone to this worm attack are Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP.
The worm will arrive as an attachment with a file extension of .bat, .cmd, .exe, .pif, .scr, or .zip. The email will have random subjects, contents and name of attachments. It listens on all TCP port 3127 till TCP port 3198. It performs a denial-of-service (DoS) attack against the software business site www.sco.com. It attacks the site if the system date is February 1, 2004 or later. It ceases attacking the site and running most of its routines on February 12, 2004. This worm runs a backdoor component, which it drops as the file.
#### Payload or damages caused by this worm are:
- Sending out large worm infected emails to email addresses found in the PC's address book but excludes email addresses ending with .edu domains.
- Degrades performances as it launches DOS to www.sco.com
- Allows unauthorized remote access via a backdoor that it creates upon infection on TCP port 3127
Currently, foreign anti-virus vendors has rated the spread of this worm as high risk. Foreign security experts had commented that this worm is spreading faster than the spread of last year's Sobig.F worm. Network Associates Inc. of US , said that some businesses have shut down their e-mail gateways in order to block the worm.
Reports from major Asia Pacific CERTs (APCERT) indicate that the current situation on the spread of this worm is not severe in Asia Pacific region.
The propagation of the worm in Malaysia was detected this morning, 27th January 2004 based on analysis of anti-virus filters at local email gateways. Untill this noon, MyCERT has received less than 10 reports from Malaysian users regarding this worm and a single local organization's email filter has blocked 233 emails infected with the above worm since from this morning till noon.
Currently, the severity of the outbreak of this worm could not be predicted for our constituency since we have not received as many reports yet for escalation. There could be possibility of organizations been affected, but they're reluctant to report to us. However, we would like to advise all internet users to be aware of this new worm and take preventive measures before their PCs become a victim of this worm.
#### Preventive Measures
1. MyCERT strongly urges users not to open any unknown attachments that they receive via emails. They should delete any suspicious emails or they may forward to the respective ISPs or CERTs for verification.
Users may refer to the following guidelines on safe email practices:
[https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=96fa0022-2ca9-47cb-975f-0d1225cc278e](https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=96fa0022-2ca9-47cb-975f-0d1225cc278e
)
2. Users should make sure that their PCs are installed with anti-virus softwares and are updated continuously with latest signature files. Users who do not have an anti-virus installed in their PCs may download an anti-virus from the following site:
[https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=b83f4c4d-f1e2-4a9d-ab55-6389ae1f6efc](https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=b83f4c4d-f1e2-4a9d-ab55-6389ae1f6efc
)
3. System and Network Administrators should apply anti -virus filters at their email gateways to block worm infected attachments.
#### Removal
PCs that had been infected by the above worm could be fixed by the following steps:
- Disconnect the PC from the network
- Download an Automatic Removal Tool provided by Trend Micro from a non-infected PC into a media.
The automatic removal tool is available at:
http://www.trendmicro.com/download/dcs.asp
After downloading the automatic removal tool, you need to run the tool on the infected PC to detect and clean up the worm.
- Re-scan the PC with an updated Anti-virus to verify the PC is clean
- Re-connect the PC back to the network
MyCERT can be reached for further assistance at:
Tel: 03-89961901
Fax: 03-89960827
Email: [[email protected]](/cdn-cgi/l/email-protection)
https://www.mycert.org.my
#### References:
1. http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM\_MIMAIL.R
2. http://securityresponse.symantec.com/avcenter/venc/data/[[email protected]](/cdn-cgi/l/email-protection)
3. http://www.computerworld.com/securitytopics/security/story/0,10801,89450,00.html