Thu, Jan 29, 2004 page12

• Mydoom infects 16% of e-mails

  ANOTHER DAY, ANOTHER VIRUS As the latest malicious computer code replicated itself through computers worldwide, security experts described it as a ``nuisance''

  • BLOOMBERG
  • • 
    • 
    • 

  A computer virus called Mydoom has infected about 16 percent of e-mail messages worldwide and shows no signs of slowing. SCO Group Inc, whose Web site is under attack by the virus, offered a US$250,000 reward for the arrest and conviction of the malicious code's author.

  Mydoom has probably infected 250,000 computers via e-mail since yesterday, said Tony Magallanez, at engineer with Helsinki-based security-software maker F-Secure Oyj. That's the highest since the SoBig worm that slowed or shut down hundreds of thousands of computers in August.

  "The rate of infection has not declined, but it has leveled off at about 16 percent of all e-mail messages worldwide," said Magallanez from San Jose, California. The rate of infection has stopped increasing in the last few hours as companies have deployed more programs to clean up their computers, he said.

  Mydoom is slowing company e-mail systems by installing a command in infected computers to send a flood of information requests to SCO's Web site when the computer's clock shows the date is on or after Feb. 1, F-Secure and Symantec Corp said.

  SCO, which is trying to collect royalties from companies using the Linux operating system, said its Web site was down for 10 minutes today. While the company isn't certain Mydoom was to blame, it wants to head off any possible attacks scheduled for Sunday, spokesman Blake Stowell said.

  "They're going to have a lot more trouble in a few days," said Craig Schmugar, a virus research manager with Network Associates Inc's McAfee division, referring to Lindon, Utah-based SCO.

  Personal computers whose clocks are set wrong are probably responsible for the attacks on SCO, Magallanez said.

  Such PCs with incorrect clock settings are probably less than a half of 1 percent of all infected machines, Schmugar said.

  The rate of infection of e-mail has not slowed as expected, monitoring by McAfee shows. The company, which obtains reports of infected messages from e-mail service providers, expects the virus to taper off after yesterday morning San Francisco time, Schmugar said.

  "February 12th may be the only certain thing that makes this stop," said Schmugar, citing the date on which Mydoom's attack on SCO is programmed to conclude.

  SCO is working with the FBI and the US Secret Service but has been given no information about the possible identity of the virus's author, SCO's Stowell said.

  "This is the biggest attack since August," said Oliver Friedrichs, senior manager for Security Response at Symantec, the world's largest maker of anti-virus software. Mydoom, also called Novarg and a variant of the MiMail virus, is rated a "Level 4" attack, a designation last used for the Blaster worm in August.

  The state of Pennsylvania discovered e-mails infected with the virus on its network, said Lee Feirick, a computer manager for the state. No computer networks have been forced to shut down he said.

  "It's definitely a nuisance," he said.

  Procter & Gamble Co, the largest US maker of household goods, is "working on an anti-virus update to protect against a rapidly spreading Internet virus," spokesman Doug Shelton said.

  Officials at six of the largest US telecommunications companies, including Verizon Communications Inc and AT&T Corp, said the virus hadn't disrupted service on their networks. At Qwest Communications International Inc, the fourth-biggest US local carrier, the virus has been a "nuisance," spokesman Steven Hammack said.

  Mydoom is more powerful than previous viruses because it can randomly change the kinds of e-mail attachments it sends and it can search Web sites to find valid e-mail addresses, security experts said.

  A series of virus outbreaks in the past year has boosted shares of security-software companies. Shares of Network Associates have gained 45 percent since the start of August, while Symantec has risen 70 percent and F-Secure 97 percent.
• Most Popular

  • 1

    Podul intensifies as it approaches: CWA

  • 2

    Taipei interested in restoring ties with Honduras: ministry

  • 3

    Public debate held ahead of nuclear referendum

  • 4

    Sinner, Sabalenka reach Cincinnati quarter-finals

  • 5

    Lai urges people to vote ‘no’ in nuclear energy referendum