Feeds

Latest MyDoom hunts victims via Yahoo!

More! viral! madness!

  • alert
  • submit to reddit

The Power of One eBook: Top reasons to choose HP BladeSystem

Another new version of the MyDoom worm is spreading, and like last week's variant it uses Yahoo! as part of its infection routine.

MyDoom-Q is similar to earlier MyDoom variants. It normally spreads via email, with a spoofed sending address and a variety of different subject lines. The body of an infected email contains random sentences, some of which refer to the attached Zip file that contains viral code. Once opened, this payload file copies itself to the Windows system directory as "winlibs.exe." The executable contains a list of dozens of common first and surnames that it puts through Yahoo's 'People Search' function in an attempt to find more email addresses to target for infection. It also scours files on the infected user's hard drive for future potential victim.

MyDoom-M (AKA MyDoom-O), released last week, also tried to exploit search engines in a similar way. The earlier version of the email worm plugged domain names into Yahoo, Google, AltaVista and Lycos search engines in an effort to find valid email addresses. This caused slowdowns and prevented many people from being able to search the web using Google, the worst affected site. However, Yahoo's People Search function appears to be responding normally despite the arrival on the scene of MyDoom-Q last night.

According to early analysis, MyDoom-Q does NOT leave a backdoor on infected PCs. This marks it out from previous MyDoom variants which used this feature to create a network of compromised, zombie PCs.

MyDoom-Q is far less virulent than its more aggressive predecessor, with most AV firms putting it into the medium-risk category. As usual My-Doom-Q is a Windows-only menace. Standard precautions apply avoid opening unsolicited attachments, even when they appear to come from people you trust, and update AV tools to detect the worm. AV vendors are in the process of updating signature definitions to recognise MyDoom-Q with protection largely in place.

Even AV firms are getting sick of the sight of fresh versions of MyDoom with both Sophos and F-Secure appealing to members of the computer underground to turn in MyDoom';s author. In January, Microsoft put up a $250,000 bounty for information leading to the arrest and conviction of MyDoom’s creator. SCO has also put up a $250,000 bounty on head of the same, elusive individual. ®

Related stories

Google goes gimpy from MyDoom infection
We're all MyDoomed
Microsoft attack worm rides on the back of MyDoom
Delivering the 12kb Bomb
MyDoom and NetSky cause chaos
MS posts $250,000 MyDoom worm bounty

The Power of One eBook: Top reasons to choose HP BladeSystem

More from The Register

next story
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
BMW's ConnectedDrive falls over, bosses blame upgrade snafu
Traffic flows up 20% as motorway middle lanes miraculously unclog
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.