A new virus, known by a number of names including MyDoom and Novarg, was discovered Monday and is spreading like wildfire around Australia, with more than 20,000 infections detected within 2 hours of discovery on Monday, according to iDefence.
Disturbingly, this virus uses random text in the subject and body, and random file attachments with extensions .exe, .scr, .zip or .pif. You can only be infected by opening the attachment, and some of the random text strings use common mail-delivery failure responses, which encourage you to open them to see which mail message bounced.
When you open the virus, it searches your hard drive and starts emailing addresses it finds in file located there. It lies, or spoofs, about who the sender of the email is, which means that innocent people may get errors sent back to them from virus scanners on receipient machines, and it is also impossible to identify who is really infected. The worm also installs a key-logger, which can capture passwords and other sensitive information entered into the keyboard. These are accessed by hackers through a "back door" which it opens up on your computer.
Additionally, infected computers send data out to the website of the SCO Group, who enraged the open-source community last year by claiming they owned some key elements of free software champion Linux, and started demanding licence fees and suing IBM.
Another disturbing reality is that there is very little 'social engineering' at play in this virus - aside from some of the random text making it look like it came from a mail server, it is mostly sending itself as gobbldy-gook with a weird attachment with a dangerous file extension, and people are still opening it and infecting themselves.
To protect yourself, ensure your virus definitions are up to date. Many anti-virus programs only update once a week, and this virus has only been in the field since Monday, so you may need to manually prompt your virus program to update. If you are using Norton Anti-virus, use the LiveUpdate tool to update your definitions. Additionally,
Symantec has published a removal tool at to help you clean up your machine if you are infected. Remember, this virus can only affect Windows computers - Macintosh and Linux are safe.
With our systems having recieved many hundreds of copies of this virus in the last 24 hours, I would classify this attack, anecdotally, as one of the fastest we have ever seen.