republican-creole
Search:  

 
 
   News
newer
story category MyDoom Spreads Quickly
New worm set to DDOS SCO Group
(old news - 09:30AM Tuesday Jan 27 2004)
tags: security · trouble
Clicking along at a faster pace than the "SoBig" worm did, the "Mydoom" virus exploded on Monday and is now making life difficult for many admins, who discuss the spread in our security forum. Apparently the worm's primary goal is to launch a DDOS attack against the SCO Group, an organization that has become public enemy number one to some in the Linux community. SCO has been under fire for its claims that portions of the open-source operating system fall under the company's copyrights (they own rights to the UNIX OS). The worm's mail engine is capable of sending out 100 infected e-mail messages in 30 seconds, which quickly clogged many mail servers over the past 24 hours. The specifics (including common headers) and removal instructions for MyDoom can be found over at SARC.

Related:
  1. DNS Flaw Even Worse Than Predicted
  2. Thursday Evening Links
  3. Monday Morning Links
  4. Friday Evening Links
  5. Wednesday Evening Links
  6. PA Man Charged With Selling Hacked Cable Modems
  7. FoxNews.com Serving Up Infected Ads?
  8. T-Mobile Systems Hacked?
Forums » MyDoom Spreads Quickly
view: topics flat text 
Post a:

Sarick
It's Only Logical
Premium
join:2003-06-03
USA

I wonder if someone wants the MS bounty.

Looks like microsoft is the target of another WORM.

Brianv5
Low Level Functionary
Premium
join:2001-01-20
Keyser, WV

Re: I wonder if someone wants the MS bounty.

Where do you get MS from anywhere in that post?
--
There is no spoon.

alien9999999
Your Head Looks Nice
Premium
join:2002-05-21
B-3000

Re: I wonder if someone wants the MS bounty.

well, SCO is the private law firm by M$... looks like two heads in one stone...

not that I approve of worms, I got enough mail as it is. and not that it is necessary in any rate, the SCO group is unbelieved anyway...

they just take dollars from M$ and spend them on lawyers...
--
Alien is my name and headbiting is my game.
bobwired
Premium
join:2003-08-04
Sidney, IL

Re: I wonder if someone wants the MS bounty.

Actually, Micro$oft was(maybe still is) a large owner of SCO stock. SCO and Microsoft have always been linked together.

IMHO, SCO has always sucked, but until late (the lawsuits) they only made their customers unhappy, now they are trying real hard to make the whole world unhappy.

The only form of life lower than SCO is the scum that launches attacks on them by sending us all viruses.

SuperJudge
Magus
Premium
join:2002-11-14
Albany, GA
clubs:

Re: I wonder if someone wants the MS bounty.

They haven't always been linked together as such. SCO had an anti-trust suit against Microsoft over DR-DOS some time ago.
--
MediaXPeer

alien9999999
Your Head Looks Nice
Premium
join:2002-05-21
B-3000

Re: I wonder if someone wants the MS bounty.

so it appears that SCO has always been like that...
--
Alien is my name and headbiting is my game.

SuperJudge
Magus
Premium
join:2002-11-14
Albany, GA
clubs:

Re: I wonder if someone wants the MS bounty.

Yeah, ever since SCO was bought out, and became SCO Group, they've been one of the more letigious groups for sure.
--
MediaXPeer

DrTCP
Yours truly
Premium,ExMod 1999-04
join:1999-11-09
Round Rock, TX
The lawsuit was between Caldera and MS. SCO bought Caldera after the lawsuit was over.

alien9999999
Your Head Looks Nice
Premium
join:2002-05-21
B-3000

Re: I wonder if someone wants the MS bounty.

and the lawyers with it...

xl5

@67.71.x.x

Let's get this straight... SCO (Santa Cruz Operation, now known as Tarantella) sold its UNIX business to Caldera International. SCO changed its name to Tarantella and Caldera changed its name to The SCO Group. The litigous SCO Group is in reality a reinvented Caldera International, a well known LINUX developer and distribution.

alien9999999
Your Head Looks Nice
Premium
join:2002-05-21
B-3000

Re: I wonder if someone wants the MS bounty.

damn those caldera bastards...

SuperJudge
Magus
Premium
join:2002-11-14
Albany, GA
clubs:

said by Brianv5 See Profile:
Where do you get MS from anywhere in that post?

Seriously. SCO is Santa Cruz Operation, I didn't see MS anywhere.
--
MediaXPeer

akristov

join:2001-01-31
Tampa, FL
clubs:

Re: I wonder if someone wants the MS bounty.

MS did give SCO $1 billion dollars for licenses. I think most people believe it is really to undercut Linux claims to legitimacy.
hescominsoon

join:2003-02-18
Brunswick, MD
·Comcast
·Verizon Online DSL

said by Brianv5 See Profile:
Where do you get MS from anywhere in that post?

this worm only affects windows....
--
God Blesshttp://www.faithwalk.org

dddane

join:2002-01-10
Chicago, IL

Re: I wonder if someone wants the MS bounty.


Sheriff BIll
Look out, Bill is comin for you!!

Sarick
It's Only Logical
Premium
join:2003-06-03
USA
·FrontierNet Intern..


1 edit
Oh but it effects MS OS's.

I'm reading between the lines. The main target is SCO the target OS to deploy the WORM is Windows.

Should have read WORM exploits MS OS again.
--
Sarick's Dungeon Clipart Page
Trouble spelling? www.iespell.com

alien9999999
Your Head Looks Nice
Premium
join:2002-05-21
B-3000

Re: I wonder if someone wants the MS bounty.

sorry, but the target is linux.

it's very easy; the virus does not do a good job, because it clobbers mail servers up too much and less DDoS.

most mail-servers are linux or unix, but not likely to be SCO or caldera. linux has nothing to gain from this, except bad publicity, so the target is linux (and open source).
--
Alien is my name and headbiting is my game.

Sarick
It's Only Logical
Premium
join:2003-06-03
USA
·FrontierNet Intern..

Re: I wonder if someone wants the MS bounty.

Then the target is wider than just MS, SCO or Linux.

Lets get this straight..

1. Microsoft OS is targeted for it's insecure setup.
2. In turn causes systems to be hijacked and flood the internet SCO with DDoS attacks.
3. Followed up by Linux servers and other E-mail servers getting slammed.
4. Ending with productivity etc etc etc..

Who's the real target. Everyone, but the GUN of the operation was MS..

So in order of targets

•1st SCO.. They are where the attack is sent.

•2nd Microsoft OS .. They are the opportunity and gun of the operation.

•3rd Email servers. Innocent bi-standards of the attack.

•4th Everyone else..

Ok remove Microsoft from this equation.

3 and 4 wouldn't exist.
--
Sarick's Dungeon Clipart Page
Trouble spelling? www.iespell.com

alien9999999
Your Head Looks Nice
Premium
join:2002-05-21
B-3000

Re: I wonder if someone wants the MS bounty.

and 1 would not happen too...
wilburyan

join:2002-08-01
Microsoft isn't the target... learn to read.

shans001

join:2000-08-13
Chesapeake, VA

1 edit

Re: I wonder if someone wants the MS bounty.

No but from the SARC link, MS is the bullet.
LOL MS is harboring Virus's of mass destruction (VMD).

Sarick
It's Only Logical
Premium
join:2003-06-03
USA
I guess that's my problem I read to much. Do to my EXTERNAL reading I knew slightly more about the WORM than was listed in the article.

Sarick
It's Only Logical
Premium
join:2003-06-03
USA
·FrontierNet Intern..

Re: I wonder if someone wants the MS bounty.

As said by new.com.com

Antivirus companies were scrambling on Monday afternoon to learn more about the virus, which started spreading at about noon PST. The virus affects computers running Windows versions 95, 98, ME, NT, 2000 and XP.
--
Sarick's Dungeon Clipart Page
Trouble spelling? www.iespell.com

Doctor Olds
I Need A Remedy For What's Ailing Me.
Premium,VIP
join:2001-04-19
1970 442 W30
clubs:
Not MS, but The Santa Cruz Organization (SCO) at »www.sco.com/
lucylew
Premium
join:2003-07-06
Tacoma, WA
LOL

Liontaur
Lets Get Boincing Already
Premium,MVM,ExMod 2004-06
join:2001-11-03
Salmon Arm, BC
clubs:

Poor poor SCO

Well this is the first i've heard about the SCO link. Is it official yet that SCO has no friends at all?

SRFireside

join:2001-01-19
Houston, TX

Re: Poor poor SCO

I suppose that's what happens when you start off as a prominent Linux OS provider and then decide to do a complete about face regarding open source and going to bed with the "enemy" (signing with Microsoft).

You would figure people would know better by now NOT to open attachments from strange email.

Jason Levine
Premium
join:2001-07-13
USA

Re: Poor poor SCO

said by SRFireside See Profile:
You would figure people would know better by now NOT to open attachments from strange email.
Or from known e-mail addresses unless you were expecting it or confirmed that the person meant to send it to you.
--
-Jason Levine
http://www.jasons-toolbox.com/
http://www.PCQandA.com/
http://www.urateit.com/

DrTCP
Yours truly
Premium,ExMod 1999-04
join:1999-11-09
Round Rock, TX

said by SRFireside See Profile:
I suppose that's what happens when you start off as a prominent Linux OS provider and then decide to do a complete about face regarding open source and going to bed with the "enemy" (signing with Microsoft).

You would figure people would know better by now NOT to open attachments from strange email.

SCO did SCO Unix may years before they even bought Unix rights. They became Linux provider after they bought Caldera. They did not start off as "prominent" to begin with.

daniyel

join:2001-05-10
Tucson, AZ

Agreed. SCO has really set off the internet fart of our present days.

I would not doubt if SCO made the virus, just to look like poor old innocent VICTIMS, who get their CODE stolen and are attacked constantly.

"Darl McBride says No free Lunch, No Free Linux"

I say.....who is laughing now

~corp greed

IronChefMoto
Premium
join:2001-02-08
Alpharetta, GA

said by Liontaur See Profile:
Well this is the first i've heard about the SCO link. Is it official yet that SCO has no friends at all?

Maybe the RIAA? Misery loves company?

IronChefMorimoto
--
Desktop: Abit NF7-S 2.0 | AMD AthlonXP 2500+ | 1GB PC3200 DDR | 128MB ATI Radeon 9500 Pro
Laptop: Dell Latitude C810 | Intel PIII-M | 512MB PC133 SDRAM | 32MB Nvidia GeForce2 Go

jose3030
Premium
join:1999-08-17
Manassas, VA

Virus

ParanoiaInc

join:2002-08-28
Tucker, GA

I love My Doom!

I also hate SCO, as they are right up there with MPA and RIAA.

technick
Premium
join:2000-12-16
Loganville, GA

yay!!! kill sco!

Sorry.. I mean I hate virus, but any virus that targets the enemy isn't that bad, but still annoying..

Jason Levine
Premium
join:2001-07-13
USA

Re: yay!!! kill sco!

said by technick See Profile:
Sorry.. I mean I hate virus, but any virus that targets the enemy isn't that bad, but still annoying..

I dislike SCO's actions as well, but any virus that opens a backdoor and can download and execute files is just bad news. Actually, I consider any virus bad news no matter who it attacks. I don't want my PC to be taking part in a DDOS attack of any kind. It is possible to boo both the virus and SCO at the same time.
--
-Jason Levine
http://www.jasons-toolbox.com/
http://www.PCQandA.com/
http://www.urateit.com/

hurleyp

join:2000-06-20
Ottawa, ON

Novarg

I've received the Novarg variant of MyDoom three times in the past 12 hours. NAV caught them, along with something called "Trojan.Downloader.Inor". Here we go again
snkeyes3

join:2003-09-23

Re: Novarg

I got 3 of 'em in the past hour or so...2 in the last 5 minutes. NAV caught 'em all, but now I wanna go home at lunch and rescan my personal machines (which I just scanned yesterday).
snkeyes3

join:2003-09-23

Re: Novarg

Ooops...my bad. I've now received 8 copies in just over an hour.

Maxo
Your tax dollars at work.
Premium,VIP
join:2002-11-04
Tallahassee, FL
clubs:

Bad effects?

Does this negatively affect the victims computer in any way?

See 14 replies to this post
RayW
Premium
join:2001-09-01
Layton, UT
clubs:

About 8 by now and I do not get these normally!

I use webwasher to filter them out, so I do not even get them into my mail reader.

My Yahoo mail has none, hotmail surprisingly only had 1.
--
I am not lost, I find myself every time.

Affliction

@bc.ca

Meh, I'm not as worried about it as Blaster.

This may have been a bad year for worms, but none of them were seriously damaging to the casual home user.

reub2000
Premium
join:2001-12-28
Evanston, IL

And I would want to remove this why?

quote:
The specifics (including common headers) and removal instructions for MyDoom can be found over at SARC.
DDoS the corpartaion who wants to cage free software!
syco_mix

join:2004-01-27
Dallas, TX

just one more reason i love my mac

you guys all in a frenzy over this worm, lol, such an easy thing to avoid, dont run the target os on a targeted platform. long live apple and gratz on the big 20 my fine digital fruit

reub2000
Premium
join:2001-12-28
Evanston, IL

Re: just one more reason i love my mac

Yep, I'll remember a Mac when I'd like a prebuilt. I like building an x86 computer. And an easy way not to get this is not to open the stupid e-mail. And linux is 100x better than OSX, and isn't affected by this worm.

Duo Maxwell
What? Stop Looking At Me Like That

join:2003-03-31
Racine, WI

Re: just one more reason i love my mac

THen tink really different, put Linux on a Mac, since you can build a G4 system: »www.google.com/search?q=Build+yo···oe=UTF-8

insomniac84

join:2002-01-03
Schererville, IN

Re: just one more reason i love my mac

thats just stupid.
syco_mix

join:2004-01-27
Dallas, TX

Re: just one more reason i love my mac

the only thing that is ever stupid is when people post one liner reply to a well thought out opinion, now if you were also posting an opinion you would show your self as a truely intelligent primate, but hey if they can teach chimps to fly a rocket then i guess anyone can learn to type. =)
syco_mix

join:2004-01-27
Dallas, TX

ahh aye, linux is the stuff, but who said i wasnt running it? true for the most part i do run OS X, but gopta love the happy little mandrake linux PPC build uhhh kinda old but i think it is 7.1 but hey thats what updates and patches are for hehe, and yes building a system does have it's merit, but thats like building your own car, why bother when you can just buy a BMW?

fatmanskinny
Premium
join:2004-01-04
Wandering
·Comcast Digital Vo..
·Comcast

Time to run a scan

I didn't receive any strange e-mails today besides the usual spam. To help with this virus issue and spam, I have Mailwasher on my computer. It allows me to "preview" the e-mail on the server before actually downloading it to my computer. I can also bounce it back to the recipient and make it appear as if my e-mail account doesn't exist and auto-delete e-mails marked as spam. Pretty good software.

Just to be on the safe side, I made sure Norton is updated and have begun scanning my computer.
--
I choose to be rich over being poor. I choose abundance instead of lack.

nil
Java Geek
join:2000-11-27

This worm is bad news

It's doing dictionary attacks against domains it finds (dunno where) on the infected PC.

It's going to get worse.
--
Life is too short to be boring
kpatz
MY HEAD A SPLODE
Premium
join:2003-06-13
Manchester, NH

Re: This worm is bad news

said by nil See Profile:
It's doing dictionary attacks against domains it finds (dunno where) on the infected PC.
When I unpacked the worm and pulled text strings, I found a handful of names listed, maybe 50 or so, not enough to constitute an effective dictionary attack. I also found a list of domains or partial names that the worm *avoids* sending emails to.

Have you seen evidence (mailserver logs) that indicate that the worm is indeed doing dictionary attacks? I would think there would be a lot more bounces in that case.

nil
Java Geek
join:2000-11-27

Re: This worm is bad news

Over 10K hits on our server today. Every IP hits a lot of times.. Average of 50-100 hits per source IP.
--
Life is too short to be boring

Rally1

join:2000-06-12
Irvine, CA
·AT&T U-Verse


3 edits

removal tool

I used the trendmicro tool myself on a local PC, but it was more involved, since found one step tools:

»www.sophos.com/support/disinfect···oma.html

»vil.nai.com/vil/stinger/

Others may want to chime in on it's effectiveness.

InfamousCow
Milk is overrated
Premium
join:2003-09-23
Collegeville, PA
clubs:

Re: removal tool

Is this a worm or a virus? Both are mentioned but they are different.
--
The day of the Bovine is at hand! MoO
kpatz
MY HEAD A SPLODE
Premium
join:2003-06-13
Manchester, NH

Re: removal tool

Technically, it's a worm. But a lot of folks use the term "virus" and "worm" interchangeably. Heck, even I'm guilty of this.

shans001

join:2000-08-13
Chesapeake, VA
·Cox HSI

Re: removal tool

I feel that a worm is a virus. As in nature, a virus is a set of instructions encased in a protein shell. A virus in nature is not a living thing for it doesn't contain a cell. This term is appropriate for the computer world where a virus is a set of instructions in a file. A worm is a set of instructions so it is a virus. Just my $.02 worth
kpatz
MY HEAD A SPLODE
Premium
join:2003-06-13
Manchester, NH

Re: removal tool

said by shans001 See Profile:
This term is appropriate for the computer world where a virus is a set of instructions in a file. A worm is a set of instructions so it is a virus. Just my $.02 worth
Well, notepad.exe is a set of instructions in a file. So is that a virus?

As you mentioned, a biological virus isn't a living thing; it has to infect a living cell in order to replicate and spread. A computer virus, if you go by the strict definition, also cannot run or spread by itself; it has to infect other programs/files in order to spread. Worms are stand-alone executables that spread by copying themselves across systems; they don't infect other executables (this is why anti-virus programs can't "clean" worm-infected files).

Da22in
Buck Fush

join:2002-06-10
Charlotte, NC
clubs:

what if...

So...if a worm came out that was designed to DDoS the RIAA, I wonder how many would let it run it's course for awhile. An uninvited, but useful guest.

FLECOM
Bay Networks Freak
Premium
join:2003-03-03
Miami, FL

Re: what if...

the day that happens i will purosly infect every pc i can in every major business and university hehe
--
BellSouth sucks

fatmanskinny
Premium
join:2004-01-04
Wandering
·Comcast Digital Vo..
·Comcast

I spoke too soon! Doh!

I started receiving e-mails today through Yahoo Bulk Mail. I was planning to let one download to one of my 4 computers just to see what havoc it plays. Of course, it was going to be a computer that does not have any info on it, no e-mail setup and no software (besides Windows default install software).

For my POP3 e-mail, I have Mailasher to preview e-mail before I download onto computer. Sweet piece of software.

--
I choose to be rich over being poor. I choose abundance instead of lack.

72276539
Premium
join:2001-01-19
Atlanta, GA

Looks like SCO.com is in fact fubarred

What are people getting for the IP when they do a NSLookup? I got 216.250.128.12.
Forums » MyDoom Spreads Quickly


Sunday, 08-Nov 00:36:47 Terms of Use | Privacy Policy | Hosting by www.nac.net - DSL,Hosting & Co-lo | feedback | contact
over 10 years online! © 1999-2009 dslreports.com.