Discovered: November 8, 2004
Updated: February 13, 2007 12:29:43 PM
Also Known As: W32.Mydoom.AI@mm, Win32.Bofra.B [Computer Associ, Win32.Bofra.C [Computer Associ, Bofra.A [F-Secure], Bofra.C [F-Secure], I-Worm.Bofra.a [Kaspersky], I-Worm.Bofra.b [Kaspersky], I-Worm.Bofra.c [Kaspersky], W32/Mydoom.ag@MM [McAfee], W32/Bofra.C.worm [Panda], W32/Bofra-A [Sophos], W32/Bofra-C [Sophos], W32/Bofra-E [Sophos], WORM_BOFRA.A [Trend Micro], WORM_BOFRA.C [Trend Micro]
Type: Worm
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP
W32.Bofra.A@mm is a mass-mailing worm that exploits the Microsoft Internet Explorer Malformed IFRAME Remote Buffer Overflow Vulnerability (as described in
Microsoft Security Bulletin MS04-040). The worm also spreads by sending an email to the email addresses that it finds in the Windows address book.
Notes:
- Virus definitions dated November 16, 2004 or earlier may detect this threat as W32.Mydoom.AI@mm.
- Rapid Release definitions 11/16/2004 rev. 50 with sequence number 38482 or later will detect this threat as W32.Bofra.A@mm.
Protection
-
Initial Rapid Release version November 9, 2004
-
Latest Rapid Release version January 21, 2010 revision 053
-
Initial Daily Certified version November 9, 2004
-
Latest Daily Certified version January 22, 2010 revision 007
-
Initial Weekly Certified release date November 9, 2004
Click for a more detailed description of Rapid Release and Daily Certified virus definitions.
Threat Assessment
Wild
-
Wild Level: Low
-
Number of Infections: 0 - 49
-
Number of Sites: 3 - 9
-
Geographical Distribution: Low
-
Threat Containment: Easy
-
Removal: Moderate
Damage
Distribution
Writeup By: Kaoru Hayashi
Technorati
Digg
Delicious
Reddit
StumbleUpon
Yahoo Buzz
Twitter
Facebook
Newsvine
