Novarg Computer Virus

Discovered on: January 26, 2004

Systems infected:

• Windows 2000,
• Windows 95,
• Windows 98,
• Windows Me,
• Windows NT,
• Windows Server 2003,
• Windows XP

System not infected: DOS, Linux, Macintosh, OS/2, UNIX, Windows 3.x

W32.Novarg.A@mm is a mass-mailing worm. The worm will arrive as an attachment with a file extension of .bat, .cmd, .exe, .pif, .scr, or .zip.

When the machine gets infected, the worm will set up a backdoor into the system by opening TCP ports 3127 thru 3198. This will potentially allow a hacker to connect to the machine and utilize it as a proxy to gain access to it's network resources. In addition, the backdoor has the ability to download and execute arbitrary files.