Feeds

MyDoom dies today

Ding dong the wicked worm is dead

  • alert
  • submit to reddit

Security for virtualized datacentres

MyDoom-A is programmed to stop spreading today, marking the end of arguably the worst email-borne viral epidemic to date.

MessageLabs, the email filtering firm, blocked the virus 43,979,281 times in the two weeks since its first appearance in late January. At the height of the epidemic, one in 12 emails the firm scanned were viral.

At the height of the Sobig-F pandemic last August one in 17 emails scanned by MessageLabs were viral. MessageLabs has blocked 33 million copies of SoBig-F, so MyDoom-A is the worst virus in terms of sheer weight of numbers too.

MyDoom-A was programmed to launch a denial of service attack against www.sco.com from infected machines. This – along with its spread – will cease today (see below for caveat*).

However the back door component of the virus has no time limit; it is still running on pox-ridden PCs.

Infected machines still need to be identified and decontaminated. This is doubly important because the recently-released Doomjuice worm uses this back door access to direct infected machines to packet Microsoft’s Web site.

MyDoom-A infected anything between 400,000 and one million PCs, according to sundry estimates from AV firms. On Tuesday, Feb 10, 67,000 IP addresses were actively scanning to and from port 3127, the back door left open by MyDoom-A, according to the SANS Institute's Internet Storm Center. This suggests many users have cleaned up their act.

Worst ever Windows worm - till the next one, anyway

MyDoom-A has outstripped Love Bug, SirCam and even Sobig-F in prevalence, but its overall impact is smaller than that of Slammer and Blaster. In scanning for fresh victims, Blaster generated copious quantities of traffic that had a measurable effect on Internet performance.

This is small comfort for the numerous users with prominent Net addresses, like us at The Reg. We were carpet bombed by the worm, whose email spoofing tactics created mass confusion and a tsunami of virus-related auto-responder spam.

Some AV packages have configurable alert responses but many AV systems will automatically send virus sender alerts to users who did not send the virus and are not infected. This causes more network traffic and waste valuable time as users look to disinfect uninfected machines. That's to say nothing of the wider legal and business implications of falsely accusing someone (potentially a business partner) of spreading a virus.

There are various theories about why MyDoom-A spread so rapidly. The multi-threaded nature of its spreading routines means that infected machines generated more crap. The worm was programmed to avoid sending itself to AV firms, Microsoft, government or the military – a tactic apparently designed to avoid the early detection of the worm. MyDoom used subtle social engineering tricks, for example impersonating standard email system messages, as a way of fooling unwary users into opening malicious attachments.

Some AV firms say the virus simply “got lucky”.

Forgive us if that doesn't make us feel any better - it’s only a matter of time before a similarly effective piece of malware is next released.

The effects of the worm raises yet again questions about the effectiveness of traditional AV scanner software. What SoBig-F and now MyDoom-A have shown is that these technologies are powerless at restraining a prolific email worm. ®

* The worm will stop packeting SCO and cease spreading from infected machines following the first system reboot after 02:28:57 GMT today. It will continue to spread from machines whose system clock is set incorrectly so what we'll see is MyDoom-A tailing off to background noise levels rather than disappearing entirely.

Related Stories

Latest Email worm (MyDoom) has SCO-facing payload
SCO posts $250,000 worm bounty
MyDoom assault forces SCO.com off the net
Worms pour through MyDoom back door
Sobig-F is fastest growing virus ever - official
And now we are One. Many unhappy returns to SoBig
Sobig-F blamed for massive increase in spam
Mafia recruiting spammers, crackers, AV chief warns
Virus writers outpace traditional AV
The trouble with anti-virus

Beginner's guide to SSL certificates

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.