Security threats Toolkit

MyDoom seeks to destroy antivirus firms

Tags:
F-Secure,
Viruses,
Jaschen,
Worm

Dan Ilet ZDNet.co.uk

Published: 18 Oct 2004 13:05 BST

Worm writers have threatened to attack antivirus companies F-Secure, Symantec, Trend Micro and McAfee.

In the latest version of MyDoom – MyDoom.AE – the authors embedded a message ridiculing rival worm NetSky and promising to attack the antivirus companies.

The message has left antivirus companies unsure of what to expect.

"It remains to be seen what they mean by threatening to attack us," said Mikko Hypponen, director of antivirus research for F-Secure. "That might mean a denial-of-service attack [DoS]. We've been a target before, but they haven't tried any recently."

Hypponen said that the message included comments on previous viruses, poking fun at the NetSky writer Sven Jaschan for being arrested: "Because Jaschan has been arrested, he is no longer a player in the virus war. And MyDoom wanted to highlight they had won the war."

The message read: "Lucky's Av's ;P~.
Sasser author gets IT security job and we will work with Mydoom , P2P worms and exploit codes .
Also we will attack f-secure,symantec,trendmicro,mcafee , etc.
The 11th of march is the skynet day lol [laugh out loud].
When the beagle and mydoom loose, we wanna stop our activity <== so Where is the Skynet now? lol. [sic]."

The worm has yet to cause any significant damage because it was released at the weekend, Hypponen added.

"It hasn't been too big a problem yet," he said. "That could be because it was released on Saturday and most people don't open their email then. This means that people will have had time to update."

On the F-Secure Web log, Hypponen said he was astonished that virus writers continued to create worms when they knew there was a $250,000 bounty for information leading to their capture.