Mass-Mailing Mydoom Worm Threat

Network traffic and email inboxes are being clogged with bogus emails after the appearance on Monday of a new mass-mailing MIMAIL worm. The worm, called Mydoom, Novarg, Shimgapi or WORM_MIMAIL.R, infects PCs running Microsoft Windows operating systems and spoofs the sender name of its messages so that they appear to have been sent by different users. It also installs a backdoor letting the virus writer control PCs, remove or change data, and install third party programs. Users of the Kazaa peer-to-peer file sharing network can also infected.

The inquirer has analysis from Kaspersky Labs on the MyDoom epidemic, TrendLabs has declared a yellow alert to control the spread of the worm and Symantec has issued a security response with removal instructions.

Unlike other mass-mailing worms, Mydoom does not attempt to trick victims by promising nude pictures of celebrities or mimicking personal notes. Instead, one of its messages reads: “The message contains Unicode characters and has been sent as a binary attachment.”

“Because that sounds like a technical thing, people may be more apt to think it’s legitimate and click on it,” said Steve Trilling, senior director of research at the computer security company Symantec.

Subject lines also vary but can include phrases like “Mail Delivery System” and “Mail Transaction Failed.” The attachments have “.exe,” “.scr,” “.cmd” or “.pif” extensions, and may be compressed as a Zip file. Besides sending out tainted e-mail, the program appears to open up a backdoor so that hackers can take over the computer later. Symantec said the worm appeared to contain a program that logs keystrokes on infected machines. It could collect username and passwords of unsuspecting users and distribute them to strangers. Network Associates, however, did not find the keylogging program. The worm also appears to deposit its payload into folders open to users of the Kazaa file-sharing network. Remote users who download those files and run them could be infected.

Yahoo! News
E-Mail Worm Clogging Network Traffic