Mydoom Worm Sets Speed Records - Tilted Forum Project Discussion Community

Glad-I-Ate-Her · 01-27-2004, 03:55 PM

Here is some info about the latest email threat. Protect yourselves.

Glad

~~~~~~~~~~~~~~~~~~~
http://www.pcworld.com/news/article/0,aid,114461,00.asp

Mydoom Sets Speed Records

New worm is spreading faster than Sobig.F, experts say.

PC World
Paul Roberts, IDG News Service
Tuesday, January 27, 2004
Mydoom, a new computer virus spreading by e-mail, is breaking records for new infections, antivirus vendors and security companies say.

Infected e-mail messages carrying the Mydoom virus, also known as "Shimgapi" and "Novarg," have been intercepted from over 142 countries and now account for one in every 12 e-mail messages, according to Mark Sunner, chief technology officer at e-mail security company MessageLabs.

That surpasses the Sobig.F virus record, which appeared last August and, at its peak, was found in one of every 17 messages intercepted by MessageLabs, he says.

Since first detecting the new virus at 1:00 PM GMT on Monday, MessageLabs intercepted almost 1 million infected e-mail messages carrying the virus, Sunner says.

The virus has "followed the sun," hitting hard in the U.S. and Canada late on Monday, then working its way through Asia and Europe on Tuesday, he says.

F-Secure of Helsinki estimates that around 100,000 computers have been infected with Mydoom so far, says Mikko Hypponen, manager of antivirus research at F-Secure.

Antivirus experts expect another large wave of infections in the U.S. and Canada on Tuesday morning, as workers who missed the virus late Monday return to their desks, he says.

Tech Talk
The worm arrives as a file attachment in an e-mail with a variety of senders and subjects, such as "Hello," and "test." The message body is often technical sounding, imitating the look and feel of an automatically generated message from an e-mail server, Sunner says.

For example, some e-mail messages telling recipients that "the message contains unicode characters and has been sent as a binary attachment," or "The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment."

Users who click on the attachment, which uses a variety of file extensions such as ZIP, SCR, EXE, and PIF, are infected with the virus.

The technical pitch is a new twist on so-called "social engineering" techniques used by virus writers to trick users into opening malicious file attachments. Mydoom's authors may have been counting on the fact that people trust the authenticity of computer generated messages more than those purporting to come from other humans, Sunner says.

Mimicking the language of a computer-generated administrative message may have also helped Mydoom spread within large corporations, where employees are used to receiving such messages from administrative systems, according to David Perry, public education director at antivirus company Trend Micro.

Going to Work
Trend Micro saw evidence on Monday of infections from 12 of the Fortune 100 companies, he says.

Once inside such companies, Mydoom could use the enormous bandwidth of those corporate networks and huge e-mail address books as a "springboard" to the rest of the Internet, Perry says.

While Mydoom has shattered Sobig.F records, in many ways the two viruses are the same, antivirus experts agree.

Both viruses scan infected computers for e-mail addresses that are then targeted by infected e-mail. Also, both Sobig.F and Mydoom are small and contain highly efficient SMTP engines for sending out copies of themselves. The efficiency of their mail engines means that even a small number of infections can generate a massive amount of e-mail traffic, Hypponen says.

Finally, both Sobig.F and Mydoom contain a Trojan horse program that gives remote attackers full control of the infected system, he says.

In the case of Sobig.F, experts theorized that the virus was being used to assemble "zombie" networks of machines for distributing spam e-mail. A similar motive may be behind Mydoom, though the virus writer's intentions are not yet clear, says Perry.

Turbine · 01-27-2004, 04:30 PM

Why is it that whenever these virii outbreaks occur I never get a single copy of it in my mailbox?

cheerios · 01-27-2004, 04:35 PM

'cuz you filter it, or your ISP does?

merkerguitars · 01-27-2004, 04:35 PM

Hehe thank god my isp has email protection built in

Reese · 01-27-2004, 04:38 PM

Turbine, maybe because no one has you in their address book.

I'm just wondering why this is spreading so much faster, haven't these people learned anything from the huge infections that keep sweeping the world.

sailor · 01-27-2004, 05:49 PM

Quote:

Originally posted by cybermike
Turbine, maybe because no one has you in their address book.

I'm just wondering why this is spreading so much faster, haven't these people learned anything from the huge infections that keep sweeping the world.

I keep wondering the same thing. This virus has all but choked our campus email. I have gotten several infected emails, but Im not one to open random attachments.

ratbastid · 01-27-2004, 05:51 PM

You know, I hate email virii as much as the next guy, but... This sucker is time-bombed to launch a massive DDoS against SCO. So I'm a little of-two-minds about it....

I hate to condone this sort of behavior. At the same time, it's going to hurt SCO.

brandon11983 · 01-27-2004, 06:21 PM

This is why I'm glad I don't have any friends. I never get any shit like this.

sailor · 01-27-2004, 07:18 PM

Quote:

Originally posted by ratbastid
You know, I hate email virii as much as the next guy, but... This sucker is time-bombed to launch a massive DDoS against SCO. So I'm a little of-two-minds about it....

I hate to condone this sort of behavior. At the same time, it's going to hurt SCO.

I felt the same at first, but then I realized that the last thing the linux community needs in this fight is the bad press that this will generate. Make no mistake, this virus, while entertaining, is a bad thing.

mokle · 01-27-2004, 07:24 PM

Quote:

Originally posted by ratbastid
You know, I hate email virii as much as the next guy, but... This sucker is time-bombed to launch a massive DDoS against SCO. So I'm a little of-two-minds about it....

I hate to condone this sort of behavior. At the same time, it's going to hurt SCO.

That doesn't really matter. SCO deservers to be hurt in the courts. Virii hurt everyone in the process.

ApexgriN · 01-27-2004, 07:27 PM

Yay for MAC OSX!

suckers!

grumpyolddude · 01-27-2004, 09:23 PM

So, what part of "Don't open email from strangers" does the world not understand yet?

fik · 01-27-2004, 10:06 PM

Quote:

Originally posted by grumpyolddude
So, what part of "Don't open email from strangers" does the world not understand yet?

Well a lot of viruses disguise the infected email into looking like it came from someone you know, someone that has your email in their address book.

Bivens · 01-27-2004, 10:53 PM

Quote:

Originally posted by ApexgriN
Yay for MAC OSX!

suckers!

Your time will come.

Lebell · 01-27-2004, 10:58 PM

sigh,

just don't open attachments.

I never do, unless I confirm from the sender it's something I need.

skysooner · 01-28-2004, 07:19 AM

I got one at work, and they filter pretty heavily. Luckily I realized that an e-mail that says Hi and has a zip file attached from someone I don't know wasn't to be trusted. I passed it to IT, and they had most of it filtered pretty quickly.

omega2K4 · 01-28-2004, 07:39 AM

You deserve to get a virus if you open e-mail attachments.

KWSN · 01-28-2004, 08:27 AM

Quote:

Originally posted by ApexgriN
Yay for MAC OSX!

suckers!

Good for you guys, you don't get the virus!

All you need is a working OS now!

numist · 01-28-2004, 08:30 AM

My friend received the email in linux, realized what it was, and installed windows just so he could be part of the ddos.

I think I may contract it myself for the same purpose.

After all, the ends justify te means, do they not?

and KWSN - HAHAHAHAHAHA

bermuDa · 01-28-2004, 09:47 AM

A client of mine had about 35 quarantined e-mails that might've had the virus. No damage was done but he was still freaked out over it.

Redlemon · 01-28-2004, 09:48 AM

The damn thing is also inventing its own TO addresses. I have a domain, and I'm receiving about 10 a day to addresses that I've never set up.

tinfoil · 01-28-2004, 11:21 AM

Indeed it is, redlemon.

This one came on fast and tapered off fast as well. At work here, the gateway was picking them off at a rate of 6 a minute at it's peak, then tapering off to about 1 a minute for most of yesterday night and this AM.

All of a sudden they stopped. Very wierd.

hawkeye · 01-28-2004, 11:29 AM

Quote:

Originally posted by KWSN
Good for you guys, you don't get the virus!

All you need is a working OS now!

*rereads*
*falls off chair laughing*

Crack · 01-28-2004, 05:34 PM

Quote:

Originally posted by grumpyolddude
So, what part of "Don't open email from strangers" does the world not understand yet?

Hell, open all e-mails from strangers! Just don't open the attachment, that's all.

merkerguitars · 01-28-2004, 09:23 PM

Quote:

Originally posted by grumpyolddude
So, what part of "Don't open email from strangers" does the world not understand yet?

Yeah I don't get some people.....it's common sense that I wish most people had

runman · 01-29-2004, 02:33 AM

Go out and buy a decent operating system eh? You could drive a truck throught the sloppy mess that is windoze!

one OS to rule them all... X

teseniarkc · 01-29-2004, 05:59 AM

I think SCo deserves this. How are they going to sue when Linux is virtually built by everyday users that download it off of the internet and send back improvements to make the OS better. WTF! Every OS that I have seen steals from the other. Look at Bill Gates for example. He lied, cheated, and now he is rich. That is the way this world works. I don't know how this is going to be proved the amount of line code there is.

indiretto · 01-31-2004, 12:38 AM

What is SCO? A virus hit my comp yesterday. I don't know if it was this one, I rarely use e-mail but I have a friend who was checking his on my computer yesterday. What ever hit my computer fraged my whole computer. I lost everything and had to write zeros to my HD, bummer for me. So far my HD and computer seem to be doing ok with the reinstall though. As for all you Linux users out there I'm still playing with it. I’m impressed with how far Linux has come in the last few years; soon it will be as easy to use, and as compatible as Windows, its pretty close now, keep up the good work.

Jizzosh · 01-31-2004, 01:49 PM

Wow, I'm soo glad I don't do the security engineer thing anymore. Otherwise I'd be looking at those 12 hour days.

viper11885 · 01-31-2004, 02:16 PM

Luckily, I don't open any attachments which I don't expect. Even from friends. But we usually do things over icq so I know what is going to be sent as an attachment by email. Helps keep things more secure as I don't need to open any emails at all that I don't expect.

riptide4070 · 01-31-2004, 06:40 PM

no virus on my cpu, better knock on wood though

soccerchamp76 · 01-31-2004, 07:11 PM

Could someone explain this thing between ddos, SCO, Linux, Windows, etc?
I have read all of these in this thread and I am very lost. What was the virus designed for? And what does it do on the site.

Edit: Googled and found out that it is an attack on the SCO site because of the lawsuit between Linux open-sourcer's and SCO.

If you have the virus, how will you know you have it and what does it do?

santafe5000 · 01-31-2004, 08:39 PM

Guess this could also explain the slowness of the net foe the pasrt few days. My pages have been very slow in loading. Several times i couldn't log onto MSN. Lots of emails clogging the system. Haven't gotten any of the e-mails myself. Good VS program.

punx1325 · 02-01-2004, 12:58 PM

My internet at school goes down daily because of this virus. The bastards that create these viruses need to be drug out in the street and shot. I have 2 online classes and can never get any work done. What is wrong with these people who have nothing better to do than make other peoples life hell???

Blistex · 02-01-2004, 10:19 PM

When are people gonna get it through their head that jokes attached to e-mails are seldom funny and are not worth the cost of re-installing your pc and having to explain to the boss why every computer in the office is now fragged!

Women are the worst. I used to have a summer job at an office and every day they'd open the same attachments and every day norton would go ape shit trying to keep up.

jwells777 · 02-01-2004, 10:32 PM

Honestly in the past, if you didn't want your computer infected, it was relatively easy to avoid being infected. These days...computers are infected so quickly and easily. This summer I had to reinstall my research computer due to the blaster worm. While reinstalling, and before I could apply the patch, the computer was infected again...so irritating.

01-27-2004, 03:55 PM	#1 (permalink)
Glad-I-Ate-Her Junkie Location: 1 mile from Ground Zero	Mydoom Worm Sets Speed Records Here is some info about the latest email threat. Protect yourselves. Glad ~~~~~~~~~~~~~~~~~~~ http://www.pcworld.com/news/article/0,aid,114461,00.asp Mydoom Sets Speed Records New worm is spreading faster than Sobig.F, experts say. PC World Paul Roberts, IDG News Service Tuesday, January 27, 2004 Mydoom, a new computer virus spreading by e-mail, is breaking records for new infections, antivirus vendors and security companies say. Infected e-mail messages carrying the Mydoom virus, also known as "Shimgapi" and "Novarg," have been intercepted from over 142 countries and now account for one in every 12 e-mail messages, according to Mark Sunner, chief technology officer at e-mail security company MessageLabs. That surpasses the Sobig.F virus record, which appeared last August and, at its peak, was found in one of every 17 messages intercepted by MessageLabs, he says. Since first detecting the new virus at 1:00 PM GMT on Monday, MessageLabs intercepted almost 1 million infected e-mail messages carrying the virus, Sunner says. The virus has "followed the sun," hitting hard in the U.S. and Canada late on Monday, then working its way through Asia and Europe on Tuesday, he says. F-Secure of Helsinki estimates that around 100,000 computers have been infected with Mydoom so far, says Mikko Hypponen, manager of antivirus research at F-Secure. Antivirus experts expect another large wave of infections in the U.S. and Canada on Tuesday morning, as workers who missed the virus late Monday return to their desks, he says. Tech Talk The worm arrives as a file attachment in an e-mail with a variety of senders and subjects, such as "Hello," and "test." The message body is often technical sounding, imitating the look and feel of an automatically generated message from an e-mail server, Sunner says. For example, some e-mail messages telling recipients that "the message contains unicode characters and has been sent as a binary attachment," or "The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment." Users who click on the attachment, which uses a variety of file extensions such as ZIP, SCR, EXE, and PIF, are infected with the virus. The technical pitch is a new twist on so-called "social engineering" techniques used by virus writers to trick users into opening malicious file attachments. Mydoom's authors may have been counting on the fact that people trust the authenticity of computer generated messages more than those purporting to come from other humans, Sunner says. Mimicking the language of a computer-generated administrative message may have also helped Mydoom spread within large corporations, where employees are used to receiving such messages from administrative systems, according to David Perry, public education director at antivirus company Trend Micro. Going to Work Trend Micro saw evidence on Monday of infections from 12 of the Fortune 100 companies, he says. Once inside such companies, Mydoom could use the enormous bandwidth of those corporate networks and huge e-mail address books as a "springboard" to the rest of the Internet, Perry says. While Mydoom has shattered Sobig.F records, in many ways the two viruses are the same, antivirus experts agree. Both viruses scan infected computers for e-mail addresses that are then targeted by infected e-mail. Also, both Sobig.F and Mydoom are small and contain highly efficient SMTP engines for sending out copies of themselves. The efficiency of their mail engines means that even a small number of infections can generate a massive amount of e-mail traffic, Hypponen says. Finally, both Sobig.F and Mydoom contain a Trojan horse program that gives remote attackers full control of the infected system, he says. In the case of Sobig.F, experts theorized that the virus was being used to assemble "zombie" networks of machines for distributing spam e-mail. A similar motive may be behind Mydoom, though the virus writer's intentions are not yet clear, says Perry. __________________ I'm "Glad I Ate Her" because the payback was worth it!!

01-27-2004, 04:35 PM	#4 (permalink)
merkerguitars Buffering......... Location: Wisconsin...	Hehe thank god my isp has email protection built in __________________ Donate now! Ask me How! Please use the search function it is your friend. Look at my mustang please feel free to comment! http://www.tfproject.org/tfp/showthread.php?t=26985

01-27-2004, 04:38 PM	#5 (permalink)
Reese Delicious	Turbine, maybe because no one has you in their address book. I'm just wondering why this is spreading so much faster, haven't these people learned anything from the huge infections that keep sweeping the world. __________________ “It is better to be rich and healthy than poor and sick” - Dave Barry

01-27-2004, 06:21 PM	#8 (permalink)
brandon11983 Stereophonic Location: Chitown!!	This is why I'm glad I don't have any friends. I never get any shit like this. __________________ Well behaved women rarely make history.

01-27-2004, 07:27 PM	#11 (permalink)
ApexgriN Tilted	Yay for MAC OSX! suckers! __________________ - apexGrin

01-27-2004, 04:30 PM	#2 (permalink)
Turbine Upright	Why is it that whenever these virii outbreaks occur I never get a single copy of it in my mailbox?

01-27-2004, 04:35 PM	#3 (permalink)
cheerios Banned Location: 'bout 2 feet from my iMac	'cuz you filter it, or your ISP does?

01-27-2004, 05:51 PM	#7 (permalink)
ratbastid Darth Papa Location: Yonder	You know, I hate email virii as much as the next guy, but... This sucker is time-bombed to launch a massive DDoS against SCO. So I'm a little of-two-minds about it.... I hate to condone this sort of behavior. At the same time, it's going to hurt SCO.

01-27-2004, 09:23 PM	#12 (permalink)
grumpyolddude Deliberately unfocused Location: Amazon.com and CDBaby	So, what part of "Don't open email from strangers" does the world not understand yet? __________________ "Regret can be a harder pill to swallow than failure .With failure you at least know you gave it a chance..." David Howard

01-27-2004, 10:58 PM	#15 (permalink)
Lebell Cracking the Whip Location: Sexymama's arms...	sigh, just don't open attachments. I never do, unless I confirm from the sender it's something I need. __________________ "Of all tyrannies, a tyranny exercised for the good of its victims may be the most oppressive. It may be better to live under robber barons than under omnipotent moral busybodies. The robber baron's cruelty may sometimes sleep, his cupidity may at some point be satiated; but those who torment us for our own good will torment us without end, for they do so with the approval of their own conscience." – C. S. Lewis The ONLY sponsors we have are YOU! Please Donate!

01-28-2004, 07:19 AM	#16 (permalink)
skysooner Registered User Location: Oklahoma	I got one at work, and they filter pretty heavily. Luckily I realized that an e-mail that says Hi and has a zip file attached from someone I don't know wasn't to be trusted. I passed it to IT, and they had most of it filtered pretty quickly.

01-28-2004, 07:39 AM	#17 (permalink)
omega2K4 Natalie Portman is sexy. Location: The Outer Rim	You deserve to get a virus if you open e-mail attachments. __________________ "While the State exists there can be no freedom. When there is freedom there will be no State." - Vladimir Ilyich Lenin "Reason has always existed, but not always in a reasonable form."- Karl Marx

01-28-2004, 08:30 AM	#19 (permalink)
numist Banned Location: UCSD, 510.49 miles from my love	My friend received the email in linux, realized what it was, and installed windows just so he could be part of the ddos. I think I may contract it myself for the same purpose. After all, the ends justify te means, do they not? and KWSN - HAHAHAHAHAHA

01-28-2004, 09:47 AM	#20 (permalink)
bermuDa don't ignore this--> Location: CA	A client of mine had about 35 quarantined e-mails that might've had the virus. No damage was done but he was still freaked out over it. __________________ I am the very model of a moderator gentleman.

01-28-2004, 09:48 AM	#21 (permalink)
Redlemon Devoted Donor Location: New England	The damn thing is also inventing its own TO addresses. I have a domain, and I'm receiving about 10 a day to addresses that I've never set up. __________________ I can't read your signature. Sorry.

01-28-2004, 11:21 AM	#22 (permalink)
tinfoil Fucking Hostile Location: Springford, ON, Canada	Indeed it is, redlemon. This one came on fast and tapered off fast as well. At work here, the gateway was picking them off at a rate of 6 a minute at it's peak, then tapering off to about 1 a minute for most of yesterday night and this AM. All of a sudden they stopped. Very wierd. __________________ Get off your fuckin cross. We need the fuckin space to nail the next fool martyr.

01-29-2004, 02:33 AM	#26 (permalink)
runman Upright Location: ocean grove australia	Go out and buy a decent operating system eh? You could drive a truck throught the sloppy mess that is windoze! one OS to rule them all... X

01-29-2004, 05:59 AM	#27 (permalink)
teseniarkc Tilted	I think SCo deserves this. How are they going to sue when Linux is virtually built by everyday users that download it off of the internet and send back improvements to make the OS better. WTF! Every OS that I have seen steals from the other. Look at Bill Gates for example. He lied, cheated, and now he is rich. That is the way this world works. I don't know how this is going to be proved the amount of line code there is.

01-31-2004, 12:38 AM	#28 (permalink)
indiretto Tilted Location: USA, Oregon	What is SCO? A virus hit my comp yesterday. I don't know if it was this one, I rarely use e-mail but I have a friend who was checking his on my computer yesterday. What ever hit my computer fraged my whole computer. I lost everything and had to write zeros to my HD, bummer for me. So far my HD and computer seem to be doing ok with the reinstall though. As for all you Linux users out there I'm still playing with it. I’m impressed with how far Linux has come in the last few years; soon it will be as easy to use, and as compatible as Windows, its pretty close now, keep up the good work. __________________ Happy Tree Friends... It’s more fun than a stick. Last edited by indiretto; 01-31-2004 at 12:41 AM..

01-31-2004, 01:49 PM	#29 (permalink)
Jizzosh Insane Location: Beijing, China	Wow, I'm soo glad I don't do the security engineer thing anymore. Otherwise I'd be looking at those 12 hour days. __________________ I'm never gonna know you now... but I'm gonna love you anyhow -Elliott Smith

01-31-2004, 02:16 PM	#30 (permalink)
viper11885 Insane	Luckily, I don't open any attachments which I don't expect. Even from friends. But we usually do things over icq so I know what is going to be sent as an attachment by email. Helps keep things more secure as I don't need to open any emails at all that I don't expect.

01-31-2004, 06:40 PM	#31 (permalink)
riptide4070 Addict Location: Boone, NC	no virus on my cpu, better knock on wood though __________________ "the greatest trick the devil ever pulled, was making the world believe he didn't exist" -Kevin Spacey 'The Usual Suspects'

01-31-2004, 07:11 PM	#32 (permalink)
soccerchamp76 Go Cardinals Location: St. Louis/Cincinnati	Could someone explain this thing between ddos, SCO, Linux, Windows, etc? I have read all of these in this thread and I am very lost. What was the virus designed for? And what does it do on the site. Edit: Googled and found out that it is an attack on the SCO site because of the lawsuit between Linux open-sourcer's and SCO. If you have the virus, how will you know you have it and what does it do? __________________ Brian Griffin: Ah, if my memory serves me, this is the physics department. Chris Griffin: That would explain all the gravity. Last edited by soccerchamp76; 01-31-2004 at 07:21 PM..

01-31-2004, 08:39 PM	#33 (permalink)
santafe5000 EVIL! Location: Southwest of nowhere	Guess this could also explain the slowness of the net foe the pasrt few days. My pages have been very slow in loading. Several times i couldn't log onto MSN. Lots of emails clogging the system. Haven't gotten any of the e-mails myself. Good VS program. __________________ When all else fails, QUIT.

02-01-2004, 12:58 PM	#34 (permalink)
punx1325 Junkie Location: San Diego	My internet at school goes down daily because of this virus. The bastards that create these viruses need to be drug out in the street and shot. I have 2 online classes and can never get any work done. What is wrong with these people who have nothing better to do than make other peoples life hell??? __________________ If something seems too good to be true, then it probably is....

02-01-2004, 10:19 PM	#35 (permalink)
Blistex Psycho Location: Tiger I Turret	When are people gonna get it through their head that jokes attached to e-mails are seldom funny and are not worth the cost of re-installing your pc and having to explain to the boss why every computer in the office is now fragged! Women are the worst. I used to have a summer job at an office and every day they'd open the same attachments and every day norton would go ape shit trying to keep up.

02-01-2004, 10:32 PM	#36 (permalink)
jwells777 Tilted	Honestly in the past, if you didn't want your computer infected, it was relatively easy to avoid being infected. These days...computers are infected so quickly and easily. This summer I had to reinstall my research computer due to the blaster worm. While reinstalling, and before I could apply the patch, the computer was infected again...so irritating.