MyDoom.C Making Its Way Across The Net

Iphtashu Fitz writes "eWeek is reporting that the latest variant of MyDoom is now making its way across the internet and may have been responsible for some disruptions to Microsofts website over the weekend. This new variant apparently doesn't spread via e-mail but instead scans for machines with an open TCP port 3127. This version appears to be a very stripped down version of its earlier cousins since it also doesn't leave a backdoor into infected machines nor does it have a shutoff date for when to stop attacking Microsoft." Reader billstewart adds links to reports at Australia's ABC News and carried by Reuters; Unloaded adds a link to CNET's coverage.

MyDoom

[Paleomacus]

What a stupid name for a virus. The writer must be planning to get caught.

My poor firewall logs

[Anonymous Coward]

My poor firewall logs, oh why does DoomJuice hate thee.

mydoom source

[k4_pacific]

I would think that mydoom.c would be the source file, so it should be alot easier to reverse engineer.

gcc mydoom.c -o mydoom ./mydoom

Re:mydoom source

[Comatose51]

The day when someone can pass the source code for a virus around and tell people how to compile and then run it in the email is the day I lose faith in humanity, which given what has transpired already isn't too far off. :-)

Target American Idol !!!

[simetra]

This is the perfect opportunity for someone to fix American Idol, by getting all those zombie computers to dial and vote for their favorite singers!

Re:Any legit use for 3127?

[nmoog]

Yeah, port 3127 is used for DoS attacks on Microsoft. Its best to leave it open.

Re:Is it just getting started?

[LostCluster]

contact sysadmins of appropriate networks

Tech: Hello? Is this the system administrator of the house?
Dad: Jimmy? It's a call for you.
Tech: Hello, are you the system administrator of the hose?
Jimmy: Yes, but my friends in school call me Jimmy.
Tech: Okay, Jimmy. We've detected that your house has a computer that's infected by a virus.
Jimmy: Comuputers can catch colds?
Tech: ...

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:MyDoom

[JoshWurzel]

I'm sure if the file you sent out was called "thisvirusisnamedJim.vbs", it would be called Jim.

Re:MyQuake

[grolschie]

MyDoom.III will no doubt be vaporware though. :-)

Re:Dumbass alert

[Anonymous Coward]

Awww, but it said "I Love You."
How could it be harmful if it says "I love you"?

Re:MyQuake

[b0r0din]

MyDoom.Forever!

YourDoom is MyDoom

[Anonymous Coward]

"And in international news, a new virus called W32.thisvirus.A@mm is infecting it's way through email. . ."

Re:MyDoom

[Anonymous Coward]

What a stupid name for a virus. The writer must be planning to get caught.

It's named MyDoom because he misspelled mydomain as mydoomain or something like that.

Re: Seems to be doing some damage already.

[Black Parrot]

> My girlfriend's been complaining that she can't get onto MSN all night

Shucks, you two will just have to find another way to while away the hours.

(Write me if you need suggestions. I can do ASCII art for the complicated stuff.)

No, it's an "open sores" virus

[yerricde]

No, Doomjuice is an open sores virus, as it utilizes an open sore (that is, port 3127) left by MyDoom.A to get in.

Re:When will someone use this to their advantage?

[laugau]

The MyDoom API is documented in RFC 3128. You can also look at the javadocs. It's all in there.

Wonderful

[ngyahloon]

A Microsoft spokesman said Monday that any performance problems on the company's site are likely related to countermeasures the company took to evade the MyDoom.B DDoS attack and not an attack from machines infected with the latest variant."

So in other words, to prevent MyDoom from DDoSing Microsoft's website, Microsoft decides to DDoS themselves instead. What a wonderful world!

crap

[MisterFancypants]

First Half Life 2, now the C source of Doom 3 is out in the wild... Damn, now we'll never see these games.

Re:Dumbass alert

[ePINOY]

But it said "I love you!" !!! ;)

Re:Any legit use for 3127?

[lakeland]

to make sure a virus/trojan didnt find its way on to my wifes

Learn how to use the apostrophe key. Else you might get misunderstood.

How about.....

[rspress]

How about MyWindows.xp?

Actually Microsoft should be advertising the fact that it is the best OS on the planet for virus development and deployment. It would look good on the Windows vs Linux propaganda.

MyDaikatana

[t0ny]

I heard Romero has been working on the MyDaikatana.a worm for the past five years. Unfortunately, he released it into the wild and nobody noticed; it apparently couldnt spread.

Re:mydoom source

[KillerHamster]

It's often commented that the additional steps required to execute a file on Linux would likely prevent a Linux virus from taking off in the way Windows viruses often do. However, if Linux is ever widely adopted on the desktop, given the proven stupidity of the majority of computer users, I wouldn't be too surprised to see that happen.

Subject: "Awesome Linux screensaver!"
Body: "Check out this awesome screensaver! Follow the steps below to install it. If you can, it would be helpful to switch to your root account first."

1. Save the attached file to your home directory.
2. Open a command prompt window.
3. Type: gunzip screensaver.tar.gz
4. Type: tar xvf screensaver.tar
5. Type: cd screensaver
6. Type: make
7. Type: ./install

it really makes you think...

[Anonymous Coward]

What if someone wrote a virus to target Macs? There are literally hundreds, if not thousands, of people using Mac's these days and many of them are connected to the Internet. A Mac virus of the MyDoom type could cause a pretty big problem somewhere like an art school or a large interior decorating firm. Just something to think about...

Re:MyQuake

[_Sprocket_]

MyDoom.III will no doubt be vaporware though. :-)

Although some networks will allow you to be pre-infected with an empty shell virus that will automatically download and install MyDoom.III when it begins to spread.

Re:MyQuake

[PhyreFox]

MyQuake.c will be primarily used to stress-test machines and then post the results everywhere it can.

New MyDaikatana Release Date

[Eradicator2k3]

Hey guys, I just heard from a guy who got infected by the romero.a worm that MyDaikatana is supposed to make us its bitch in 2005. Although the romero.b, .c and .d variations claim the same thing for 2006, 2007 and 2008, respectively.

Re:MyDoom

[null-sRc]

the next variant will be: ..MyDocuments...?

*shrugs*

Re:What about a CodeBlue variant?

[mrtroy]

You know when you feel like you have something really clever to say and want to say it really bad cuz you think its so amazing?

Here it is!

Why dont I create a machine that will fix your car for you too, and mow your lawn, and take out your trash and solve that pesky virginity problem of yours?

Because thats why WOMEN were invented! They solve all of the worlds problems! Go away from your computer, and find a woman who will download the new anti-virus definitions for you and solve the rest of your problems!

Now to all the women out there: YES, I am avaliable, please send me your resume containing important skillsets outlined above.

(but seriously, I am going to die alone)

Wow, a virus that updates itself over the network

[codemachine]

Next thing you know, we'll see this on Windows Update:

MyDoom.C - A critical update for the MyDoom virus is now available. This update fixes the flaw that prevented infected machines from launching DOS attacks at microsoft.com past the expiry date. Install this update if you need microsoft.com DOSing capabilities.

i can see it now ...

[LittleBigLui]

If it's making changes to PCs without their owners' permission, no matter what the motive, it's viral code, by definition.

Subject: Clickety-click!

Attachment:clickety.exe

Text:

Yeah, you know, the files you axed me for.

<SmallerFont>
By starting the attached file, you agree to: A) have remote administration software installed on your computer, B) allow that remote administration software to replicate to other computers as well, C) have a mail relay installed on your computer, D) have software that might conflict with the remote administration software (e.g. anti-virus software) disabled, E) you're not reading this anymore, are you? F) have updates to the remote administration software automatically installed, G) this text is so boring, H) even if that updates fundamentally alter the functionality of the software (e.g. DDOS the shit out of macrohard.com or dashslot.org) I) why not check out the nice file i sent you instead. J) you agree to never sue the author or distributor of this remote administration software for anything. K) no, really. the file is so nice - maybe it even makes funny sounds when you click it? L) neither anyone who uses your computer to send electronic mail, no matter what quantity or content.
</SmallerFont>


We all know, nobody reads those EULAs :)

The ULTIMATE Vaporware Virus

[rock_climbing_guy]

Here is the ultimate Vaporware Virus:

MyDukeNukeMForever.A

Re:Part of the story?

[rgigger]

uh... Microsoft can't "tail" their http logs

myDoom[a-z]

[MrBallistic]

do we have to wait for myDoom.z to come out before we start on numbers? i'm still waiting for myDoom 3 to finally get released over here ;)

Why are you contradicting yourself?

[sheapshearer]

Virus-writers don't get to name their viruses, the anti-virus companies do that.

Well you seem to be making one mistake....

The virus writers ARE the anti-virus companies!

Re:Nimda

[Cynikal]

"Maybe that's because the name [..] was already taken.

thats too bad :(, i SO wanted to release a virus named linux.vbs and watch the heated exchanges on slashdot burn a hole out of the bottom of my monitor :D

Re:The ULTIMATE Vaporware Virus

[Anonymous Coward]

It's NOT vaporware! It will be released WHEN IT'S DONE. We just had to change the virus engine from vbs to C#.NET, but it's going to be the best virus EVER. Full freedom for the user: want to send the virus to your mother, your cousin, your boss, or some random loser on /.? With MyDukeNukeMForever.A, this will not only be possible, but it'll be reality! It's going to revolutionise the way people think about viruses.

Oh, and it'll have full 256 colour VGA!

Re:MyDoom

[Anonymous Coward]

MyDoom got its name from a typo

Aha! Obviously, the author is a Slashdot editor!

You realize, of course....

[KC7GR]

...That the image of Einstein on the Slashdot header for this article isn't really an image of Einstein. Noooo, not at all. It's actually a composite representation of what SysAdmins worldwide look like after they get through battling Yet Another Worm, applying the Redmond Empire's Patch(es)-of-the-Month, reminding Clueless (L)users not to click on the pretty executable that came in their E-mail... well, you get the idea...