Additional Details

This variant sends variable emails with EXE/SCR/PIF/ZIP attachments. Some mails contain sexually excplicit images and claim that the attachment contains passwords for adult websites.



The body text of infected e-mails varies...for example:



The message contains Unicode characters and has been sent as a binary attachment.
Mail transaction failed. Partial message is available.
The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment

Detection

This variant is detected as 'I-Worm.Mydoom.AE' since the following FSAV updates:

[FSAV_Database_Version]
Version=2005-01-16_01

Write-Up: Mikko Hypponen, January 16th, 2005