Feeds

MyDoom dies today

Ding dong the wicked worm is dead

  • alert
  • submit to reddit

The Power of One eBook: Top reasons to choose HP BladeSystem

MyDoom-A is programmed to stop spreading today, marking the end of arguably the worst email-borne viral epidemic to date.

MessageLabs, the email filtering firm, blocked the virus 43,979,281 times in the two weeks since its first appearance in late January. At the height of the epidemic, one in 12 emails the firm scanned were viral.

At the height of the Sobig-F pandemic last August one in 17 emails scanned by MessageLabs were viral. MessageLabs has blocked 33 million copies of SoBig-F, so MyDoom-A is the worst virus in terms of sheer weight of numbers too.

MyDoom-A was programmed to launch a denial of service attack against www.sco.com from infected machines. This – along with its spread – will cease today (see below for caveat*).

However the back door component of the virus has no time limit; it is still running on pox-ridden PCs.

Infected machines still need to be identified and decontaminated. This is doubly important because the recently-released Doomjuice worm uses this back door access to direct infected machines to packet Microsoft’s Web site.

MyDoom-A infected anything between 400,000 and one million PCs, according to sundry estimates from AV firms. On Tuesday, Feb 10, 67,000 IP addresses were actively scanning to and from port 3127, the back door left open by MyDoom-A, according to the SANS Institute's Internet Storm Center. This suggests many users have cleaned up their act.

Worst ever Windows worm - till the next one, anyway

MyDoom-A has outstripped Love Bug, SirCam and even Sobig-F in prevalence, but its overall impact is smaller than that of Slammer and Blaster. In scanning for fresh victims, Blaster generated copious quantities of traffic that had a measurable effect on Internet performance.

This is small comfort for the numerous users with prominent Net addresses, like us at The Reg. We were carpet bombed by the worm, whose email spoofing tactics created mass confusion and a tsunami of virus-related auto-responder spam.

Some AV packages have configurable alert responses but many AV systems will automatically send virus sender alerts to users who did not send the virus and are not infected. This causes more network traffic and waste valuable time as users look to disinfect uninfected machines. That's to say nothing of the wider legal and business implications of falsely accusing someone (potentially a business partner) of spreading a virus.

There are various theories about why MyDoom-A spread so rapidly. The multi-threaded nature of its spreading routines means that infected machines generated more crap. The worm was programmed to avoid sending itself to AV firms, Microsoft, government or the military – a tactic apparently designed to avoid the early detection of the worm. MyDoom used subtle social engineering tricks, for example impersonating standard email system messages, as a way of fooling unwary users into opening malicious attachments.

Some AV firms say the virus simply “got lucky”.

Forgive us if that doesn't make us feel any better - it’s only a matter of time before a similarly effective piece of malware is next released.

The effects of the worm raises yet again questions about the effectiveness of traditional AV scanner software. What SoBig-F and now MyDoom-A have shown is that these technologies are powerless at restraining a prolific email worm. ®

* The worm will stop packeting SCO and cease spreading from infected machines following the first system reboot after 02:28:57 GMT today. It will continue to spread from machines whose system clock is set incorrectly so what we'll see is MyDoom-A tailing off to background noise levels rather than disappearing entirely.

Related Stories

Latest Email worm (MyDoom) has SCO-facing payload
SCO posts $250,000 worm bounty
MyDoom assault forces SCO.com off the net
Worms pour through MyDoom back door
Sobig-F is fastest growing virus ever - official
And now we are One. Many unhappy returns to SoBig
Sobig-F blamed for massive increase in spam
Mafia recruiting spammers, crackers, AV chief warns
Virus writers outpace traditional AV
The trouble with anti-virus

The Power of One eBook: Top reasons to choose HP BladeSystem

More from The Register

next story
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
BMW's ConnectedDrive falls over, bosses blame upgrade snafu
Traffic flows up 20% as motorway middle lanes miraculously unclog
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.