MyDoom Worm Spreading Fast; May Be Aimed At SCO

A new Internet worm, possibly a variant of the MiMail worm, quickly spread throughout the Internet Monday night and today, clogging corporate networks and degrading overall Internet performance.

Secure E-mail services provider MessageLabs reported early Tuesday morning that it is finding a MyDoom virus in one out of every 12 E-mails it checks. The company says SoBig.F, one of the most prolific viruses ever, peaked at one in 17 E-mails. So far, MessageLabs says it has intercepted more than 1.2 million copies of MyDoom coming from more than 168 countries.

Antivirus firms are still analyzing MyDoom, and many say the worm is preparing infected PCs for a distributed denial-of-service attack against the SCO Group's Web site on Feb 1. The SCO Group has upset Linux supporters and the open-source community after it made legal claims for certain portions of the Linux operating system.

Antivirus companies warn that MyDoom spreads through peer-to-peer networks and by sending E-mails with random subject headings, including "Hello." MyDoom also carries E-mail attachments with various filenames including body.zip, text.zip, and readme.zip. The worm also opens a port to listen for potential future instructions.

Most antivirus firms have updated their antivirus signatures to stop MyDoom.Web-performance-monitoring company Keynote Systems Inc. says the spread of MyDoom drastically slowed Web performance throughout Monday afternoon. According to the company, the Web performance of the top 40 U.S. businesses slowed to an average page-download of 4.0 seconds. Typical performance ranges between 2 to 3 seconds.