The first copycat of the widespread Mydoom worm appeared Wednesday on the Internet, and some analysts are warning it may be even more dangerous than the original. Dubbed Mydoom.b by most security firms, the variant strongly resembles the Mydoom, now tagged as Mydoom.a, but adds some new disturbing traits.
Some of the subject lines used by Mydoom.b depart from the original, including new headings of 'Delivery error' and 'Returned mail,' both which try to trick users into believing that the message is legit and can safely be opened.
Another change in Mydoom.b is the addition of microsoft.com as a target for a February 3 denial-of-service (DoS) attack. Mydoom.a specified sco.com as the target for a February 1 DoS assault by compromised machines; Mydoom.b has both sites and the associated dates embedded in its code.
Most notable, and most disturbing, however, is that Mydoom.b prevents infected users from accessing anti-virus and other computer support sites.
The worm modifies the host file on the compromised system so that 65 Web sites resolve to the IP address of 0.0.0.0, making them inaccessible.