F-Secure Raises ''Mydoom'' Virus to Alert Level-1; Windows Worm Launching World-Wide Attack Against SCO Website.

Business Editors/High-Tech Writers

SAN JOSE, Calif.--(BUSINESS WIRE)--Jan. 26, 2004

F-Secure is warning email users around the world about a new Windows worm which is spreading rapidly. The new worm, known as Mydoom or Novarg, is spreading through email attachments and Kazaa file sharing networks.

The worm has launched a world-wide denial-of-service attack from every infected computer against the website of SCO, one of the largest Unix vendors in the world. However, the WWW.SCO.COM site seems to be still operational.

There's been a lot of discussion about SCO after they claimed last December that the Linux operating system was violating SCO's intellectual property rights in UNIX technology. "There are a lot of kids out there who feel like SCO's attacking them," comments Mikko Hypponen, Anti-Virus Analyst at F-Secure Corporation. "Apparently one of them decided that it's OK to attack back."

In addition to the denial-of-service attack, the worm also opens up a backdoor to infected computers by listening to TCP port 3176. This way the worm author can gain access to infected computers afterwards.

The emails sent by the worm are fairly random:

From: (random email address)

To: (address of the recipient)

Subject: (random words)

Message body: (several different mail error messages, such as...) - Mail transaction failed. Partial message is available.

Attachment: (with a textfile icon) - random name ending with ZIP, BAT, CMD, EXE, PIF or SCR extension.

When a user clicks on the attachment, the worm will start Notepad, filled with random characters and it will immediately start to spread further.

NOTE TO EDITORS: Detailed technical descriptions of the worm as well as screenshots are available in the F-Secure Virus Description Database at http://www.f-secure.com/v-descs/novarg.shtml.

F-Secure Anti-Virus can detect and stop the Mydoom worm. F-Secure Anti-Virus can be downloaded from http://www.f-secure.com. F-Secure will also be releasing a free tool which can be used to remove Mydoom from infected systems.

About F-Secure

F-Secure Corporation is the leading provider of centrally managed security solutions for the mobile enterprise. The company's award-winning products include antivirus and network security solutions for major platforms from desktops to servers and from laptops to handhelds. Founded in 1988, F-Secure has been listed on the Helsinki Exchanges since November 1999. The company is headquartered in Helsinki, Finland, with the North American headquarters in San Jose, California, as well as offices in France, Germany, Sweden, Japan and the United Kingdom and regional offices in the USA. F-Secure is supported by a network of value added resellers and distributors in over 90 countries around the globe. Through licensing and distribution agreements, the company's security applications are available for the products of the leading handheld equipment manufacturers, such as Nokia.

Automatic Alert Notification:

If you only wish to automatically receive our press releases concerning viruses, please go to: http://www.F-Secure.com/news/subscribe.html and first unsubscribe from [e-mail] and then subscribe to [e-mail].

F-Secure is a registered trademark of F-Secure Corporation. PersonalExpress and Security as a Service are trademarks of F-Secure Corporation. All other company and product names may be trademarks of their respective owners.