Dangerous Mydoom [virus] Variant Appears

techweb.com via CRN ^ | 01/28/2004 | Gregg Keizer

[BigSkyFreeper]

The first copycat of the widespread Mydoom worm appeared Wednesday on the Internet, and some analysts are warning it may be even more dangerous than the original.

Dubbed Mydoom.b by most security firms, the variant strongly resembles the Mydoom, now tagged as Mydoom.a, but adds some new disturbing traits.

Some of the subject lines used by Mydoom.b depart from the original, including new headings of 'Delivery error' and 'Returned mail,' both which try to trick users into believing that the message is legit and can safely be opened.

Another change in Mydoom.b is the addition of microsoft.com as a target for a February 3 denial-of-service (DoS) attack. Mydoom.a specified sco.com as the target for a February 1 DoS assault by compromised machines; Mydoom.b has both sites and the associated dates embedded in its code.

Most notable, and most disturbing, however, is that Mydoom.b prevents infected users from accessing anti-virus and other computer support sites.

The worm modifies the host file on the compromised system so that 65 Web sites resolve to the IP address of 0.0.0.0, making them inaccessible.

The list of affected sites include major names in the anti-virus and security trade, including Symantec, McAfee, F-Secure, Sophos, Network Associates, and Kaspersky Labs. Microsoft's Office Update and Windows Update, as well as other Microsoft download locations, are also on the list.

That makes it much more dangerous than its predecessor, said Ken Dunham, the malicious code director for security firm iDefense.

"This new variant is worse than Mydoom.a," he said, because the lack of access to security and anti-virus sites will make it impossible for many users, particularly consumers, to obtain updates to protect or clean their systems. "This will result in a longer lifespan for Mydoom.b," he said.

Dunham, along with other security experts, suspect that Mydoom.b is being launched from computers already infected with the original Mydoom.a. "If this is the case," said Dunham, "Mydoom.b will likely become very prevalent in just a few hours."

Moscow-based Kaspersky Labs agreed. "Our analysts believe that Mydoom.b is probably using machines infected by the original Mydoom," said Kaspersky spokesman Denis Zenkin in an e-mailed statement. "The computer community may be facing a much more serious outbreak than the one caused by Mydoom.a yesterday."

Anti-virus firms are racing to combat Mydoom.b with updated virus definition files, but not all companies have yet posted alerts for the variant, nor updates that can defend and disinfect.

[New Horizon]

The first copycat of the widespread Mydoom worm appeared Wednesday on the Internet, and some analysts are warning it may be even more dangerous than the original.

*sigh*...of course...

[George W. Bush]

People are so stupid they can't modify their own hosts file?

Dang.

[BigSkyFreeper]

Most folks don't need a host file. Course Windows looks for it, and it's a good idea to set it "read only".

[lelio]

I think 1 out of 100 Windows users know that they have a hosts file. That's a pretty nifty trick.

[Principled]

What's a "hosts file"?

[George W. Bush]

Okay. You guys win. We're helpless morons, incapable of modifying a simple text file.

You can really see how all that computer education in the public schools is paying off.

[George W. Bush]

I'm going to report you to JohnRob!

[hsmomx3]

Bottom line: DO NOT open attachments. Question. Yahoo has an anti virus scan whenever an attachment is sent to you in your Yahoo email account. How does this compare vs. your own av?

[Texaggie79]

I ran the "message.zip" in a controlled environment when I first saw it in my email, this was before any news broke. Norton, being fully updated did not recognize any infection. So I opened it up to see a .doc file. Scanned that and nothing.

So, what the hell, I knew it had to be a virus, but I wanted to see it in action. My zonealarm pro and router firewall kept it from emailing out.

I can see though how many people would open it thinking its just a zip or doc and get infected, never knowing it was a virus.

The stupid thing was, the doc file simply runs a pif file and doesn't even open word pad. If it did, that would fool even more people. Otherwise, they are going to get suspicious and check their processes.

[mlbford2]

I am fairly computer savvy, but I have to say that I don't know what a host file is for. Can you edumecate me?

[BigSkyFreeper]

It's a text file used by the computer to resolve numerical/long name domain names. This is used in place of the ISP domain name server (DNS) which most people should use, since IP addresses sometimes change, which means manually changing the entries in the host file in the windows directory.

[Principled]

heh heh heh

[commish]

Remember there are millions of AOL Losers er I mean Users that have no idea how to do anything beyond pointing and clicking in thier browser and almost peeing themselves in excitement when they hear "you've got mail"

And it is not just point and clickers. My wife is a nurse and the Doctor that she works for (a brilliant man in many respects) has absolutely no clue how to use his home PC. I have worked on his computer for him so many times I could almost qualify as an employee.

[BobS]

Surely there is a conservative hacker out there that can create a mydoom.rat virus that will nullify those wacko dem sites?

[BigSkyFreeper]

I worked on a computer savvy user's computer once, he couldn't figure out why the 2 GHz machine was running slow. I ran a virus scan on it and found 300 viruses, worms and trojan horses running in the background. Got rid of them all and the computer was running like it had the very first day.

[George W. Bush]

Switch them all Linux LiveCDs. Then they'll never be able to screw anything up.

Surprising how many people are looking into it. Especially with memory-key support for documents and personal settings or to boot an entire system from.

It has a certain attraction. We're all about fed up with Winblows and all the virusing and updating.

LiveCDs with memory-key support let you carry your own computer environment anywhere. Virus and hacker proof.

[lelio]

A hosts file relates DNS names (ie freerepublic.com) to IP addresses (ie 209.157.64.200). Back in the Old Days this was done by copying files around computers which then looked at that file to do the lookup manually.

This worked fine when you had a dozen universities on the internet, but it fails miserably with millions of dot com names. So DNS servers came about which told you what IP address you're looking for. No more text files.

Well not quite. All *nix distributions have /etc/hosts which pretty much just lists the loopback address (localhost 127.0.0.1) and maybe their own name -> IP address in it.

Windows has a similiar "stub" file like this too. You'll have to dig around for it, but you can find it under the TCP/IP - DNS settings. Look for something like "hosts" or "lmhosts." Should be a text file with maybe 3 entries in it.

[techwench]

yes. and i work for a "brilliant" inventor that is so absent minded he would need help shutting down his own computer (a virtual goldmine for us "outsourced to india" techs)

[Cagey]

You can really see how all that computer education in the public schools is paying off.

I'd be willing to wager that most of the users on this forum went to school before PC training was even thought of in any school. Not everyone on here is under 30.