Feeds

Infected PCs spew MyDoom variant

Business as usual

  • alert
  • submit to reddit

Next gen security for virtualised datacentres

The MyDoom worm saga continued today with the release of yet another variant of the noxious email worm. The latest variant - MyDoom-S (AKA MyDoom-Q or MyDoom-R) - poses as a funny photographs in order to dupe users into opening an infectious attachment called photos_arc.exe.

MyDoom-S runs when a Windoze user (Linux or Mac users are immune) clicks on this malicious attachment. Thereafter the worm mass-mails itself to email addresses harvested from the infected machine with the subject line "photos" and message body "LOL!;))))". Like other variants of MyDoom, MyDoom-S also tries to download a backdoor Trojan (in this case Surila-G) from one of a number of websites onto infected PCs. The Trojan allows infected machines to be controlled remotely by attackers in order to send spam, for example.

Finnish AV firm F-Secure reckons virus writers bulk-mailed copies of MyDoom-S from machines infected by earlier versions of the worm in an effort to give their latest creation a kick-start.

In an advisory, F-Secure states: "The source addresses of the spams appear to be from DSL and cable modem pools, suggesting that the MyDoom gang is using a botnet created with earlier MyDoom variants to send this one out. They've also carefully checked that none of the common antiviruses detect this new variant. The worm contains a backdoor. System administrators may also want to block access to domains www.richcolour.com and zenandjuice.com from their network for a while. This variant tries to download components from these addresses but the sites themselves have nothing to do with the virus group."

MyDoom-S began spreading (fairly extensively) today. Most AV vendors rate MyDoom-S as a medium risk threat. MyDoom-S is programmed to stop spreading on 20 August 2004 but the backdoor does not have an expiration date. ®

Related stories

Latest MyDoom hunts victims via Yahoo!
We're all MyDoomed
Microsoft attack worm rides on the back of MyDoom
Google goes gimpy from MyDoom infection
Zombie PCs spew out 80% of spam
Phatbot arrest throws open trade in zombie PCs
MyDoom and Netsky cause chaos
MyDoom is the worst virus ever

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
Think crypto hides you from spooks on Facebook? THINK AGAIN
Traffic fingerprints reveal all, say boffins
prev story

Whitepapers

A new approach to endpoint data protection
What is the best way to ensure comprehensive visibility, management, and control of information on both company-owned and employee-owned devices?
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.