New Windows MyDoom Worm Searches and Destroys

The Internet Patrol - Patrolling the Internet for You

The newest version of the MyDoom worm, discovered just today, not only still creates its own SMTP engine allowing it to send email from infected machine to every email address it can find on the computer, but this new and “improved” MyDoom also uses the computer’s Internet connection to search for email addresses on Google, Yahoo, AltaVista, and Lycos, and sends itself out to any addresses it finds.

But wait, there’s more! This version of MyDoom, dubbed “MyDoom AO” also specifically searches the search engines for email addresses within its host’s domain, sending itself to as many email addresses within the host domain as it can find. For example, if the host computer sends email as joe@example.com, MyDoom looks on the search engines for as many email addresses at example.com as it can find. Then susan@example.com and don@example.com will get email from “joe@example.com”, and be much more likely to open it, thus unleashing the worm onto their computers as well. It may also be that this means that it will take only one infected machine to infect an otherwise secure network, as email addresses in the same domain may well all be behind the same firewall.


The virus also seems to display a preference for Google as, according to security firm Sophos, MyDoom AO sends about 45% of its queries through Google, another 22.5% through Lycos, 20% through Yahoo, and only 12.5% via AltaVista.

Also known as MyDoom.bb, the worm may also download the backdoor Trojan BackDoor-CEB.f to the host system.

Infected machines will have a file called “JAVA.EXE” on them.

No Paywall Here!
The Internet Patrol is and always has been free. We don't hide our articles behind a paywall, or restrict the number of articles you can read in a month if you don't give us money. That said, it does cost us money to run the site, so if something you read here was helpful or useful, won't you consider donating something to help keep the Internet Patrol free?
Click for amount options
Other Amount:
What info did you find here today?:

 

According to another security company, Panda Labs, MyDoom AO will only affect computers running Windows 2003, XP, 2000, or NT.

No Paywall Here!
The Internet Patrol is and always has been free. We don't hide our articles behind a paywall, or restrict the number of articles you can read in a month if you don't give us money. That said, it does cost us money to run the site, so if something you read here was helpful or useful, won't you consider donating something to help keep the Internet Patrol free?
Click for amount options
Other Amount:
What info did you find here today?:

One thought on “New Windows MyDoom Worm Searches and Destroys

  1. Infected machines will have a file called “JAVA.EXE� on them.

    This should go without saying, but knowing how many hoaxes have come about from things like this, it must be mentioned: Most uninfected machines will also have a file named “java.exe” on them– that’s the name of the executable for Sun’s Java runtime!

Leave a Reply

Your email address will not be published. Required fields are marked *

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.