The newest version of the MyDoom worm, discovered just today, not only still creates its own SMTP engine allowing it to send email from infected machine to every email address it can find on the computer, but this new and “improved” MyDoom also uses the computer’s Internet connection to search for email addresses on Google, Yahoo, AltaVista, and Lycos, and sends itself out to any addresses it finds.
But wait, there’s more! This version of MyDoom, dubbed “MyDoom AO” also specifically searches the search engines for email addresses within its host’s domain, sending itself to as many email addresses within the host domain as it can find. For example, if the host computer sends email as joe@example.com, MyDoom looks on the search engines for as many email addresses at example.com as it can find. Then susan@example.com and don@example.com will get email from “joe@example.com”, and be much more likely to open it, thus unleashing the worm onto their computers as well. It may also be that this means that it will take only one infected machine to infect an otherwise secure network, as email addresses in the same domain may well all be behind the same firewall.
The virus also seems to display a preference for Google as, according to security firm Sophos, MyDoom AO sends about 45% of its queries through Google, another 22.5% through Lycos, 20% through Yahoo, and only 12.5% via AltaVista.
Also known as MyDoom.bb, the worm may also download the backdoor Trojan BackDoor-CEB.f to the host system.
Infected machines will have a file called “JAVA.EXE” on them.
The Internet Patrol is completely free, and reader-supported. Your tips via CashApp, Venmo, or Paypal are appreciated! Receipts will come from ISIPP.
CashApp us
Venmo us
Paypal us
According to another security company, Panda Labs, MyDoom AO will only affect computers running Windows 2003, XP, 2000, or NT.
The Internet Patrol is completely free, and reader-supported. Your tips via CashApp, Venmo, or Paypal are appreciated! Receipts will come from ISIPP.
CashApp us
Venmo us
Paypal us
Infected machines will have a file called “JAVA.EXE� on them.
This should go without saying, but knowing how many hoaxes have come about from things like this, it must be mentioned: Most uninfected machines will also have a file named “java.exe” on them– that’s the name of the executable for Sun’s Java runtime!