Tuesday, February 22, 2005

MyDoom Worm Spreads Via Search Engines

Latest variant finds e-mail address on your hard drive and on search engines.
Internet users are being threatened by yet another variant of the MyDoom mass mailing worm, which is spreading in part by using e-mail addresses found through popular search engines, security experts warn.

The new variant was first spotted late Wednesday and reports from computer users suggest the worm is already circling the globe, according to Graham Cluley, senior technology consultant at Sophos.

The worm proliferates by e-mailing itself through its own SMTP (Simple Mail Transfer Protocol) engine, according to Sophos. When it infects a computer it scans the hard disk for e-mail addresses and then takes the domains of the addresses it finds and queries search engines such as Google, Yahoo, and Lycos looking for similar addresses, Cluley says.

If it finds the address JohnDoe@yahoo.com, for instance, it will use a search engine to look for other addresses at the yahoo.com domain to send itself to, Cluley explains.

Similar Spread

A similar MyDoom variant appeared last July and managed to slow some search engines as it flooded them with queries.

Cluley says he doubts the new variant will have the same effect since this outbreak is not as severe. Additionally, search engines have taken measures to prevent being crippled by the worm again, Cluley says.

The latest worm was created by repackaging an older MyDoom variant in an encrypted "wrapper" so that antivirus software could not recognize it, Cluley says. The method is just one of the clever ways hackers use to hide their attacks and antivirus firms should be aware of the ruse, he adds.

Internet users should make sure their antivirus software is up to date to avoid infection.
this story as reported by: Scarlet Pruitt, IDG News Service

3 Comments:

Blogger gribble said...

"The worm proliferates by e-mailing itself through its own SMTP (Simple Mail Transfer Protocol) engine, according to Sophos."

Does this mean it doesn't necessarily need to be open or activated by a user, such as and attachment?

1:48 PM  
Blogger rihooligan said...

This comment has been removed by a blog administrator.

8:23 PM  
Blogger rihooligan said...

As far as I know you don’t need to have any open active mail it will root into the existing files on the pc that contain all the info and then go from there
• Sends itself to email addresses found on the infected computer
• Drops more malware
• Forges the sender's email address
• Uses its own emailing engine
• Downloads code from the internet

8:28 PM  

Post a Comment

<< Home