New Windows MyDoom Worm Searches and Destroys   - 2,418 Views, 1 Comment

The newest version of the MyDoom worm, discovered just today, not only still creates its own SMTP engine allowing it to send email from infected machine to every email address it can find on the computer, but this new and “improved” MyDoom also uses the computer’s Internet connection to search for email addresses on Google, Yahoo, AltaVista, and Lycos, and sends itself out to any addresses it finds.

But wait, there’s more! This version of MyDoom, dubbed “MyDoom AO” also specifically searches the search engines for email addresses within its host’s domain, sending itself to as many email addresses within the host domain as it can find. For example, if the host computer sends email as joe at example dot com, MyDoom looks on the search engines for as many email addresses at example.com as it can find. Then susan at example dot com and don at example dot com will get email from “joe at example dot com”, and be much more likely to open it, thus unleashing the worm onto their computers as well. It may also be that this means that it will take only one infected machine to infect an otherwise secure network, as email addresses in the same domain may well all be behind the same firewall.

The virus also seems to display a preference for Google as, according to security firm Sophos, MyDoom AO sends about 45% of its queries through Google, another 22.5% through Lycos, 20% through Yahoo, and only 12.5% via AltaVista.

Also known as MyDoom.bb, the worm may also download the backdoor Trojan BackDoor-CEB.f to the host system.

Infected machines will have a file called “JAVA.EXE” on them.

According to another security company, Panda Labs, MyDoom AO will only affect computers running Windows 2003, XP, 2000, or NT.