Mydoom Worm (aka Mimail.R and Novarg.A)

About Mydoom  |  How to remove the worm  |  How to run a scan with Norton Antivirus

What is the Mydoom worm?

The Mydoom worm (aka Mimail.R and Novarg.A) is a mass mailing worm that is transmitted in attachments.  On campus, it may arrive as a .zip attachment.  Off campus, the attachment could have the file extensions:  .bat, .cmd, .exe, .pif, .scr, or .zip 

Systems which can be infected include:  Windows XP, Windows 2000, Windows 98, Windows 95, Windows Me, Windows NT, and Windows Server 2003
Systems not affected:  Macintosh and Linux

On campus, Norton Antivirus should be quarantining this worm as of Tuesday morning (1/27/2004).  Please remember, however, that the best practice is NOT to open attachments unless you are sure of the source.

Because this worm picks up email addresses from any infected source, you may receive messages regarding email that you did not send. Just delete those  messages as well as any from unknown sources with attachments including .zip attachments.

For more information see Symantec's Security Response site

How to remove the worm:

Download this program Fix Novarg to your desktop (courtesy of Symantec). Unplug your computer from the network. Double-click on the program to open it. Click Start. After the program has run, restart your computer Reconnect to the network.

ResNet students who have been disconnected will have to wait an hour
before being allowed to reconnect to the network, if there is no longer an infection.

Running a Scan with Norton Antivirus

Click on the yellow shield in the bottom right corner (system tray). Click Scan Computer in the left menu. Check the box to select C: (Local Drive) Click the Scan button at the bottom of the window.

If you need additional assistance, please contact MicroSupport@tntech.edu (372-6315)
or your College MicroSupport contact.