Security threats Toolkit

MyDoom attack dies away after 12 hours

Munir Kotadia ZDNet.co.uk

Published: 27 Jul 2004 13:40 BST

The latest variant of the MyDoom worm, which was discovered on Monday, peaked after around 12 hours and has already started dying out, according to antivirus firms.

Security experts have been warning about the consequences of another MyDoom outbreak after the original version caused massive disruption to the Internet and launched a DDoS attack on SCO that knocked the company's Web site offline for more than a month.

However, the latest variant of MyDoom does not appear to launched a DDoS attack.

Jack Clark, technology consultant at antivirus firm McAfee, said this MyDoom seems to be "nothing special" and is following the behaviour expected from a typical mass mailing worm, and is dying down after an initial surge.

"In the 24 hours it was discovered, MyDoom had a huge affect on the population. It had a really active period of about 12 hours but is now starting to die out," Clark said.

Natasha Staley, information security analyst at MessageLabs, said the company has intercepted just 599,641 messages containing MyDoom in its first 24 hours. This is less than half the number of infected messages caught during the 24 hours of the original MyDoom attack and is likely to keep falling as the week continues.

"MyDoom slowed down overnight and picked up again this morning, but more than likely it is a case of people's bedtime patterns. I don't expect to be here tomorrow saying there has been another 600,000 interceptions. It will probably tail off slightly tomorrow and there will be more significant drops throughout the week."

McAfee's Clark said that, unlike a Trojan horse distributed late last week disguised as suicide pictures of Osama Bin Laden, this variant of MyDoom didn't make any original effort to persuade users to open its attachment.