MyDoom.N: "trojaned proxy server"

Wednesday, August 11, 2004
Author: Webmaster

Don't let the virus writers fool you.  A recent variant of the MyDoom virus is sending out "technical support" emails or what seems like return notices.

An example of the message body:

Dear user of [domain name],

Your e-mail account has been used to send a huge amount of junk email messages during the recent week.
We suspect that your computer was compromised and now runs a trojaned proxy server.

We recommend that you follow the instructions in order to keep your computer safe.

Virtually yours,
[domain name] support team.

The [domain name] is replaced by the end of your email address.  This is especially confusing when your email address is a hotmail or yahoo account - it is almost too convincing.

Then attached with this email is a file called [domain name] (which as a .com will run as an executable), or similarly [user]@[domain name].

More information can be found here:

MyDoom.N Raised to Amber Alert

And for the removal tool:

MyDoom-N Removal


http://www.antisource.com/article.php/20040812222633772