- Related Stories
-
New Mimail mixes tricks for PayPal scam
January 16, 2004 -
Seeds of destruction
January 15, 2004 -
SCO attacks keep coming back
December 15, 2003 -
A 20-year plague
November 25, 2003 -
Microsoft bounty to disrupt virus writers?
November 5, 2003 -
Experts: Sixth son of Sobig not the last
August 25, 2003
The virus--known as MyDoom, Novarg and as a variant of the Mimail virus by different antivirus companies--arrives in an in-box with one of several different random subject lines, such as "Mail Delivery System," "Test" or "Mail Transaction Failed." The body of the e-mail contains an executable file and a statement such as: "The message contains Unicode characters and has been sent as a binary attachment."
Get Up to Speed on...
Enterprise security
Get the latest headlines and
company-specific news in our
expanded GUTS section.
In one hour, Network Associates itself received 19,500 e-mails bearing the virus from 3,400 unique Internet addresses, Gullotto said. One large telecommunications company has already shut down its e-mail gateway to stop the virus.
Once the virus infects a Windows-running PC, it installs a program that allows the computer to be controlled remotely. The program primes the PC to send data to the SCO Group's Web server, starting Feb. 1, a virus researcher said on the condition of anonymity.
The SCO Group has incurred the wrath of the Linux community for its claims that important pieces of the open-source operating system are covered by SCO's Unix copyrights. IBM, Novell and other Linux backers strongly dispute the claims.
Latest computer virus runs rampant in a high-risk outbreak
The company's Web site was slow to load on Monday afternoon, a SCO spokesperson acknowledged, but the site was still accessible from the World Wide Web.
SCO's Web site was taken offline by denial-of-service attacks a handful of times in the last year, none of which had been initiated by a virus. In the past, the company has blamed Linux sympathizers for at least one of the attacks.
Antivirus companies were scrambling on Monday afternoon to learn more about the virus, which started spreading at about noon PST. The virus affects computers running Windows versions 95, 98, ME, NT, 2000 and XP.
"A lot of the information is encrypted, so we have to decrypt it," said Sharon Ruckman, a senior director of antivirus software maker Symantec's security response center. Symantec has had about 40 reports of the virus in the first hour, a high rate of submission, Ruckman said.
|
| ||||
|
| | ||
|
Special report 20-year plague From the first experiments to today's epidemics, computer viruses have come a long way. |
| ||
|
|
||||
|
|
||||
The virus installs a Windows program that opens up a "back door" in the system, allowing an attacker to upload additional programs onto the compromised device. The back door also enables an intruder to route his connection through the infected computer to hide the source of an attack.
The virus also copies itself to the Kazaa download directory on PCs, on which the file-sharing program is loaded. The virus camouflages itself, using one of seven file names, including Winamp5, RootkitXP, Officecrack and Nuke2004. Variations in the body text include: "The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment."
Early data indicated an epidemic several times the size of the Sobig.F virus, which caused widespread infections last summer, said Scott Petry, a vice president of engineering at e-mail service provider Postini.
Reader resources
MyDoom prevention
and cure
CNET Reviews
Mail systems that remove executable files from e-mails can
- by websitehandyman September 7, 2009 10:47 AM PDT
- Here a new one on me, torrent users should take note !
<br />
<br />So you download a video file, perhaps a film or other but when you run it your media player comes up with a message - You don't have the licence needed to play this file, click here to download the free licence.
<br />
<br />You do that and still can't run the file but what you don't know is you've installed a virus. I've yet to see the full force of this virus but it does try to access web sites. Soon as it did that Avast found it. So I did a full scan and it found infected files which were deleted. Everything was fine for a while, then on bootup in vista gave an "authentication" message and I couldn't get in. A restore failed but a memory check got me back up again. But althought the pc is working find it has tried to access a web page again and avast blocked that. <br />
<br />If anyone identifys the virus I would like to know but I'll track down sooner or later.
- Like this Reply to this comment
-
(10 Comments)