Virus mobilises Kazaa army against SCO

A virulent new worm has infected thousands of users across the world within hours of being discovered.

Mydoom.A.worm spreads via email and peer-to-peer network Kazaa, but also leaves port 3127 open to allow malicious hackers to take control of compromised computers.

This virus is also ready to launch a denial of service attack against The SCO Group website on 1 February, according to MessageLabs.

Mark Sunner, chief technology officer at MessageLabs, told vnunet.com that the company expects to intercept over 1.2 million occurrences of the worm.

"The primary intention of Mydoom appears to be a denial of service attack against SCO. We don't know if it has any other intent, but we will be monitoring it," he said.

"It drops a Trojan which gives the potential for something else to happen. In terms of spread, it appears to be following the sun. In contrast with SoBig.F, it has the potential to be bigger."

According to antivirus experts at Panda Software, the ability of MyDoom.A to spread rapidly, as well as the damage it is leaving behind, makes it as serious as last summer's Bugbear and Blaster worms.

McAfee's Avert team said that the infection has already been seen throughout Asia Pacific, Canada, Europe, Japan, Latin America and the US.

Graham Cluley, senior technology consultant at Sophos, said in a statement: "If you launch that file you are potentially putting your data and computer straight into the hands of hackers."

As other countries begin their usual working day, the virus is expected to grow and create more problems.

As with most mass-mailers, MyDoom.A emails itself out as an attachment after being executed. The icon used by the file tries to make it appear as if the attachment is a text file.

It then forwards itself to all the addresses found in the affected computers. It searches email addresses in the computer files with the extensions .htm, .sht, .php, .asp, .dbx, .tbb, .adb, .pl, .wab, .txt.

MyDoom.A uses its own SMTP engine to send itself by email. The message content changes, and may contain the following:

Subject:

• Test
• Hi
• Hello
• Mail Delivery System
• Mail Transaction Failed
• Server Report
• Status
• Error

Body:

• Mail Transaction Failed. Partial message is available.
• The message contains Unicode characters and has been sent as a binary attachment.
• The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.

Attached file name:

• document
• readme
• doc
• text
• file
• data
• test
• message
• body

File extension:

• .pif
• .scr
• .exe
• .cmd
• .bat
• .zip