Web Design Directory

  w   w   w   .   d   e   s   i   g   n   d   i   r   .   n   e   t
An industry leading web design, hosting and development directory. We bring together the best web designers and their customers. Find the lates website business news and updates.
Search DesingnDIR
Advertising | Submit Site »
   » Home Page / Industry News  
  Find Services Provider       Technology Stories        WebSite Services   
Predicted Wave of Worms Hits, Then Dissipates

2005-02-22 15:14:00

The predicted wave of MyDooms continued through the weekend, security firms reported, and a new edition of Sober, the German-made worm that continues to bedevil users, made the rounds with some success.

Last week, when MyDoom.bc appeared, a security analyst at Computer Associated noted that the worm had a history of rolling out several variants in succession, then taking a break. "MyDooms usually come in a string of four or five in a row that use essentially the same code," said Sam Curry, vice president of Computer Associates' eTrust security group, last Thursday.

That's exactly what happened. Late Friday and over the weekend, McAfee tracked three new copy-cats, and dubbed them MyDoom.bd, MyDoom.be, and MyDoom.bf. Like Thursday's MyDoom.bc, the .bd and .be variants were tagged as "medium" threats by the Santa Clara, Calif.-based anti-virus vendor.

The new variations are virtually identical to MyDoom.bc, and even earlier editions going back as far as the summer of 2004 and MyDoom.o, said analysts Tuesday.

"[These] MyDooms are the latest in a prolific family, and follow on the heels of last week's MyDoom.au," said Curry Tuesday. (Computer Associates' nomenclature for the variants is somewhat different than McAfee's.) "They exhibit the same tricks and mode of operation as other MyDooms as far back as the 'O' variant, relying on social engineering to trick the innocent into engaging them and continuing the infection."

MyDoom worms are infamous for the wide variety of tricks they apply to get people to launch the attached file, which is, of course, the malicious code payload. The newest versions sport a message that purports to come from the user's Internet service provider (ISP).

"We have found that your e-mail account was used to send a huge amount of spam messages during this week," the bogus messages begin. "We suspect that your computer had been infected and now contains a hidden proxy server. Please follow the instruction in the attached file in order to keep your computer safe."

MyDoom, which has been particularly pervasive, keeps appearing in part because its source code has been circulating among hackers.

"The public availability of the MyDoom source code makes it ripe for worm authors to churn out an almost endless number of variants," said Scott Chasin, the chief technology executive at MX Logic, in an e-mail. "The result is that anyone can use the source code to develop a variant, create an army of zombie PCs with spam and worm distribution capabilities," he added.

MyDoom wasn't the only Internet pest to plague users over the three-day weekend. Another version of Sober, the German-made worm that harks back to October 2003, appeared Sunday and quickly began spreading, particularly in Europe, said the U.K.-based security firm Sophos.

Sober.k, as Sophos dubbed the worm, follows the typical pattern of arriving in either English or German versions, and using several different subject headings and message bodies to get victims to open the payload.

Some copies of Sober.k, in fact, offer free access to X-rated videos of society party girl Paris Hilton, while others take an even sneakier route by using subject headings of "Alert! New Sober Worm!" according to analysis by Symantec and others.

That last spoof carries a return address of security@microsoft.com, and includes text that reads, "ATTENTION! Antivirus vendors are warning of a new variant of the "Sober" virus discovered today that can delete the hard disk. Protection: Download and read the zipped patch. It's very easy to install! (c)2005 Microsoft Corporation. All rights reserved--- Microsoft Corporation--- One Microsoft Way--- Redmond, Washington 98052-6399"

Microsoft has repeatedly told users that it never sends security-related messages with attached files, and has warned them against opening such files.

"Although much-publicized past outbreaks should have made users more nervous of double-clicking on unsolicited attachments, some still find it hard to resist," said Graham Cluley, the senior technology consultant for Sophos, in a statement.

According to Cluley, by early Tuesday, Sober.k accounted for about 1 in every 10 viruses spotted in the past 24 hours. Only the Netsky.p and Zafi.d worms showed up more frequently.

The worm, however, seems to be fading almost as quickly as it rose to prominence, said Alex Shipp, a senior anti-virus analyst for MessageLabs, an e-mail filtering firm also based in the U.K.

"It's biggest spike was this morning," he said Tuesday, "as workers got into their offices. Even though it first appeared yesterday, some copies would have sat in in-boxes until today."

By the end of the British working day Tuesday, however, Sober.k was "dying off," added Shipp.

FBI: E-mails Bearing Worm Not From Us

Spam Costs World Businesses $50 Billion

Nearly A Third Of IM Users Have Gotten Spim

EBay Completes Rent.com Acquisition

Category-Specific Search Expected To Dominate The Market

DSL Growth Skyrocketed In 2004: Report

AT&T Expands Hotspot Network

Anti-Spam Software Revenues Seen Climbing To $1.7 Billion By 2008

Nsite, WebEx Form Collaborative Technology Partnership

Microsoft Caves In To Dutch Site On Spyware Spat



   
» Web Hosting Interviews
Web Hosting interviews, news and reviews. Compare the Best web hosting providers.
» Daw - Web Hosting Blog
Views and Comments about Hosting Industry. News, Trends, Products and Sevices.
» Your WebSite Here
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371


» Submit your site to Web Design Directory

About Us | Advertising | Privacy | Terms Of Use | Contact Us

© DesignDIR.net 2003 - 2017, part of of Business Address Network. All Rights Reserved!