January 27, 2004, 12:00 AM

From Russia, not quite with love; Mydoom is the worst yet, researcher says

The Russian-originated Mydoom e-mail worm spread faster in its first 24 hours than last year’s Soibig.F virus, e-mail security firm MessageLabs says. Keynote Systems says Mydoom’s effect on web site performance appears to have peaked yesterday.

Kurt Peters

Executive Editor

If retailers are finding customers skittish about opening their e-mail these days, blame it on the Mydoom worm. That worm, which e-mail security provider MessageLabs says originated in Russia, spread faster in its first 24 hours than last year’s Soibig.F virus, infecting 1 in 12 e-mail messages, MessageLabs reports. The Mydoom e-mail worm is also known as Novarg.

Internet performance monitoring company Keynote Systems Inc. notes that Mydoom’s effect on web site performance appears to have peaked yesterday.

MessageLabs says it first intercepted the Mydoom worm at 8 a.m. Eastern Time yesterday and that within 24 hours it had stopped more than 1.2 million copies of the virus while recording a peak infection rate of 1 in 12 e-mail messages. By contrast, it says, it stopped 1 million copies of the Sobig.F virus within its first day last year and recorded a peak infection rate of 1 in 17 e-mails.

“With a text file icon instead of graphics that lead people to believe it is innocuous, this virus appears to have hit a sweet spot in execution and propagation,” says Mark Sunner, CTO at MessageLabs. “Its success and back-door Trojan component could further increase the prevalence of open proxies for nefarious purposes."

MessageLabs notes that Mydoom is a mass-mailing worm that attempts to spread via e-mail and by copying itself to any available shared directories used by Kazaa, the music file-sharing service. The worm harvests addresses from infected machines and targets files with the following extensions: .wab, .adb, .tbb, .dbx, .asp, .php, .sht, .htm, .txt.

Keynote reports that Mydoom’s worst impact on site performance occurred yesterday, when the average home page download time for the 40 web sites in its Keynote Business 40 Internet Performance Index reached 4 seconds, compared to the more common range of 2-3 seconds. The average download had dropped to 3.2 seconds early this morning, but sites in the index began to show delays of up to 3.9 seconds by late morning, Keynote says.

In addition, Keynote says that the average number of pages available for the sites in the index dropped to 90% yesterday, compared to a usual availability of about 95%, but that availability began to rise again today.


Sign In to Make a Comment

Comments are moderated by Internet Retailer and can be removed.

Not a member? Signup for free today!




Relevant Commentary


Jason Squardo / Mobile Commerce

Five tips for achieving high mobile search rankings

Searches on mobile devices will soon exceed those on computers, Google says. Retailers that keep ...


Sergio Pereira / B2B E-Commerce

Quill turns to its B2B customers for new ideas

Coming in April is a new section of Quill.com that will let customers and Quill ...