This brand new version of MyDoom is HTML based and does not contain attachments. It also exploits a critical IE vulnerability, so AV protection plus best practices are needed -- as this one has some potential.

W32/Mydoom.ag@MM - Zero Day IE I-FRAME Attack
http://secunia.com/virus_information/13213/mydoom.ag/
http://vil.nai.com/vil/content/v_129630.htm

This W32/Mydoom@MM variant makes use of a zero day attack targeting a Microsoft Internet Explorer IFRAME buffer overflow vulnerability. The virus spreads by sending email messages to addresses found on the local system. The message appears as follows:

From: Spoofed address
Subject: may vary

* funny photos
* hello
* hey!
* blank

There is no attachment to the message. The homepage hyperlink points to the infected system which sent the email message. Clicking on the link, accesses a web server running on the compromised system. The web server serves HTML that contains IFRAME buffer overflow code to automatically execute the virus. Infected systems will show Internet Explorer listening on TCP Port 1639, the port the web server runs on. Information on the IFRAME vulnerability can be found here:

Internet Explorer IFRAME Buffer Overflow Vulnerability
http://secunia.com/advisories/12959/