Looks like there’s a new version of the MyDoom virus circulating on the Net taking advantage of another unpatched hole in Internet Explorer.
The worm, which security firms dubbed MyDoom.AF, MyDoom.AH and MyDoom.AG, spreads by e-mail and exploits a recently discovered buffer overflow vulnerability in IE.
Internet users should avoid opening suspicious e-mail with the subject headers “funny photos
,” “hello,” “hey!” and blank headers, according to security firm iDefense Inc. Users who open the infected e-mail and click on links in the message body will be directed to destinations from which an attack may be launched.
Microsoft issued a statement saying that it was aware of the new variant and an investigation is underway. According to early reports the vulnerability does not exist on Windows XP (Overview, Articles, Company) Service Pack 2 (SP2) so customers running the security update are at a reduced risk of the threat, Microsoft said. The software maker and security experts advised users to install SP2 if they have not already.
For those of you who still aren’t running Windows XP your best option is to make the switch away from IE. Hell, it’s probably your best bet even if you are running XP.
It’s not always called Mydoom (it’s technically not a Mydoom variant ... it does’t even spread in the same manner)
http://www.sophos.com/virusinfo/articles/bofra.html