By ECT News Security Desk E-Commerce Times
07/26/04 1:53 PM PT
MyDoom.O is a mass-mailing worm with an SMTP engine that sends e-mails to addresses harvested from infected machines. The sender's "from" e-mail address is forged, and therefore does not indicate the true identity of the sender.
How Much is 'Free' Costing You? Learn how DaveRamsey.com saw a 567% uplift in ROI with Omniture. This complimentary guide and webinar cover the most important factors in selecting an analytics solution. Download Now.
MessageLabs, Sophos and Keynote Systems have released alerts about the new W32.MyDoom.O worm variant that has been circulating the Internet today and causing traffic slowdowns.
This latest variant in the MyDoom virus family was first identified by MessageLabs at 4:40 ET July 26th 2004.
"Sadly, people and businesses fall prey to every one of these new virus variations, ensuring that new variants will be written and new systems compromised," noted Mark Sunner, CTO of MessageLabs.
"We are now on the 15th variant of Mydoom, on the heels of multiple new Bagle variants. For many virus writers, success is not measured in millions of copies being sent; it's measured in the number of new computers hijacked for future use."
General Characteristics of MyDoom.O
MyDoom.O is a mass-mailing worm with an SMTP engine that sends e-mails to addresses harvested from infected machines.
The sender's "from" e-mail address is forged, and therefore does not indicate the true identity of the sender.
MyDoom.O might also spoof from the mailer-daemon@ address, which is typically used to indicate a delivery failure, thus enhancing its social-engineering trickery.
The executable file is approximately 27,648 bytes in size. The virus is also packed with UPX v1.0x and stored in a ZIP attachment.
The virus is also being referred to as MyDoom.M, I-Worm.Mydoom.M, I-Worm.Mydoom.R and W32/Mydoom.L.
Additional Characteristics
The MyDoom worm can generate several different e-mails when spreading itself. A typical example sent by the virus looks as follows:
Dear user
Your account was used to send a large amount of spam during this week.
Obviously, your computer had been compromised and now runs a trojan proxy server.
Please follow instruction in order to keep your computer safe.
Have a nice day, user support team.
So, if your e-mail address was John.Smith@XYZCorp.com, the e-mail would be signed from the "XYZCorp.com user support team."
Spammers and User Computers
"Computer users are becoming aware that spammers take over innocent third party computers to send their marketing messages," said Graham Cluley, senior technology consultant for Sophos.
"This worm plays on that fear and pretends that users have already been hacked and exploited by spammers. All computer users should keep their anti-virus up-to-date and ensure they never launch an unsolicited e-mail attachment."
Sophos recommends that companies protect their e-mail with a consolidated solution to thwart the virus and spam threats as well as secure their desktop and servers with automatically updated antivirus protection.
General Network Slowdowns
Keynote Systems, a company that tracks Web site performance, has observed an atypical event today in which the Keynote Business 40 Internet Performance Index, a barometer of overall Internet speed, has degraded in both speed and reliability.
The Keynote Business 40 measures the download performance of the 40 most highly traveled, well-connected sites in the United States from 50 cities around the world.
Typical reliability for the sites on the index is 97 percent, while the download performance of the home pages of the sites on the Index is usually below 2.0 seconds. Beginning at 7:00 a.m. Pacific time today, reliability fell 1.5 percent points to 95.5 percent availability as measured on the leading backbones around the world.
Keynote believes that fallout from the MyDoom virus is causing the overall slowdown on the Internet and is also affecting in a sporadic but serious way the search performance of Google (Nasdaq: GOOG), Alta Vista and Lycos.
Keynote has done a series of automated instant search measurements from cities around the U.S. to ascertain these performance issues.
New Efforts Being Taken Against Spyware July 24, 2004
"Malware has quickly become the fastest growing segment of spyware," MX Logic CTO Scott Chasin, told TechNewsWorld. "We are seeing a significant increase in open source malware," he said. Chasin said more than 1,000 new variants of malware are released each month, most of which are Trojan horses.
Related Stories
Google, Other Sites Slowed by MyDoom Worm July 26, 2004
The reports about the worm, a variant of a Web attack called MyDoom, came as outages on the search site Google.com hit in the United States, France and Great Britain. In many places the site was said to be working normally.
McAfee Updates Virex for the OS X Enterprise July 22, 2004
"While Macintosh's are immune to infections from Windows worms like Bagle, Netsky and MyDoom, which exploit security flaws in Windows operating systems and software applications, they are not immune to PC and UNIX threats that can spread to Macintosh systems on the network via e-mail or network sharing," John Bedrick, group product marketing manager for systems security at McAfee, said in a press statement.
Online Extortion Bust Highlights Profit, Problem July 22, 2004
Gartner research Vice President Richard Stiennon, who pointed to such a scheme as responsible for the amount of variant viruses in the so-called "worm war" last spring, said the arrests are likely to deter the extortion activity, which has already spread to credit card and other payment-processing sites.
Spam Wars: The Ongoing Battle Against Junk E-Mail June 08, 2004
"We believe that technology is the most powerful tool against spam. Technology is critical not only to protecting end users from unwanted e-mail, but from protecting users from other, often more devastating e-mail threats, including viruses, worms, blended threats and denial-of-service attacks," said Scott Chasin, CTO of MX Logic, whose company provides innovative e-mail defense technologies.
Sharing Files: The Untold Story of Software Piracy June 05, 2004
When you get down to the basics, using broadband connections in the workplace to download files for personal use does more than steal productivity and cheat employers out of bandwidth costs. Employees generally are not aware of the damage their P2P and instant-messaging use does to their companies.
Related News Alerts
More by ECT News Security Desk
Sophos: Worm Spies on Innocent Computer Users August 23, 2004
Sophos believes that the W32/Rbot-GR worm is evidence of a growing trend of more and more malware spying on innocent home computer owners and poorly-protected businesses. Once installed on an infected computer, remote hackers can gain access to the information on the PC's hard drive and steal passwords as well as spy on innocent users via their webcam and microphone.
New Bagle Virus Rolls Around World August 10, 2004
The new variant, known as Bagle.aq, collects addresses from e-mail software on the infected computer and places them in the 'From' field when it sends itself. The message with the spoofed address therefore appears to be from a legitimate user.
Microsoft Windows XP Service Pack 2 Arrives August 06, 2004
"Service Pack 2 is a significant step in delivering on our goal to help customers make their PCs better isolated and more resilient in the face of increasingly sophisticated attacks," said Bill Gates, chairman and chief software architect at Microsoft.
Headline Feeds
is not measured in millions of copies being sent; it's measured in the number of new computers hijacked for future use."
Talkback: 
