MyDoom variant attacks Microsoft.com

Same author, less damage

By John Leyden • Get more from this author

Posted in Anti-Virus, 28th January 2004 20:50 GMT

A variant of the prolific MyDoom worm which is programmed to attack both Microsoft.com and SCO's Web site has been unleashed.

Like its predecessor, MyDoom-B spreads via email or the KaZaA file-sharing network.

The worm made its first appearance this afternoon and is, so far, less common than MyDoom-A, according to Alex Shipp, senior AV technologist at mail filtering firm MessageLabs.

AV vendors are still analysing the malware.

Denis Zenkin, of Russian AV outfit Kaspersky Labs, told El Reg that he is convinced the variant was released by the same person or group responsible for the original virus.

Revamping a virus requires access to source code - which hasn't yet been published on virus-writing sites, according to Zenkin.

Kaspersky also reckons MyDoom-B is probably using machines infected by the original virus to propagate, another factor which points to the same perpetrator being behind both attacks.

AV vendors are in the process of updating protection to defend against the worm. For now probably the best advice is to treat unsolicited attachments with extreme scepticism. ®