W32/Mydoom.O Worm

 Information about the W32/Mydoom.O Worm:

W32/Mydoom.O is a mass mailing worm. This worm is a variant of W32/Mydoom. The worm will infect Windows systems and spreads through email and shared network drives.

The infected email carries a spoofed 'From' address picked up randomly from the infected system.

The worm arrives with any one of the following subject:

The/Your m/Message could not be delivered
Returned mail: Data format error
Mail System Error - Returned Mail
Message could not be delivered
hi error
hello
test
report
status
delivery failed
Delivery reports about your e-mail
Returned mail: see transcript for details
The original message was included as attachment

The body of the infected mail will be any one of the following:

Dear user of <domain-name>

Mail server administrator of <domain-name> would like to inform you that
We have detected that your e-mail account has been used to send a large
amount of unsolicited e-mail messages during this recent week.
We suspect that your computer had been compromised by a recent virus and now
runs a trojan proxy server. Please follow our instructions in the attachment file
in order to keep your computer safe.
Virtually yours
<domain-name> user support team.

OR

The message was undeliverable due to the following reason(s):
Your message was not delivered because the destination computer was
not reachable within the allowed queue period. The amount of time
a message is queued before it is returned depends on local configura- tion parameters.
Most likely there is a network problem that prevented delivery, but
it is also possible that the computer is turned off, or does not
have a mail system running right now.
Your message was not delivered within <number> days:
Mail server <host-name> is not responding. The following recipients did not receive this message: <address>
Please reply to postmaster@<domain-name>
if you feel this message to be in error.

OR

The message could not be delivered

OR

The original message was received at <time> from <address>
----- The following addresses had permanent fatal errors -----
<address>
----- Transcript of the session follows -----
... while talking to host <hostname>:
>>> MAIL From:<address>
<<< 501 User unknown
Session aborted >>>
RCPT To:<address>
<<< 550 MAILBOX NOT FOUND

The original message was included as attachment

The worm carries an attachment. The name of the infected attachment will be recipient's domain name, username or from the following list;

transcript
text
readme
message
mail
letter
instruction
file
document
attachment

The infected attachment will have any one of the following extensions;