January 27, 2004, 12:00 AM

From Russia, not quite with love; Mydoom is the worst yet, researcher says

The Russian-originated Mydoom e-mail worm spread faster in its first 24 hours than last year’s Soibig.F virus, e-mail security firm MessageLabs says. Keynote Systems says Mydoom’s effect on web site performance appears to have peaked yesterday.

If retailers are finding customers skittish about opening their e-mail these days, blame it on the Mydoom worm. That worm, which e-mail security provider MessageLabs says originated in Russia, spread faster in its first 24 hours than last year’s Soibig.F virus, infecting 1 in 12 e-mail messages, MessageLabs reports. The Mydoom e-mail worm is also known as Novarg.

Internet performance monitoring company Keynote Systems Inc. notes that Mydoom’s effect on web site performance appears to have peaked yesterday.

MessageLabs says it first intercepted the Mydoom worm at 8 a.m. Eastern Time yesterday and that within 24 hours it had stopped more than 1.2 million copies of the virus while recording a peak infection rate of 1 in 12 e-mail messages. By contrast, it says, it stopped 1 million copies of the Sobig.F virus within its first day last year and recorded a peak infection rate of 1 in 17 e-mails.

“With a text file icon instead of graphics that lead people to believe it is innocuous, this virus appears to have hit a sweet spot in execution and propagation,” says Mark Sunner, CTO at MessageLabs. “Its success and back-door Trojan component could further increase the prevalence of open proxies for nefarious purposes."

MessageLabs notes that Mydoom is a mass-mailing worm that attempts to spread via e-mail and by copying itself to any available shared directories used by Kazaa, the music file-sharing service. The worm harvests addresses from infected machines and targets files with the following extensions: .wab, .adb, .tbb, .dbx, .asp, .php, .sht, .htm, .txt.

Keynote reports that Mydoom’s worst impact on site performance occurred yesterday, when the average home page download time for the 40 web sites in its Keynote Business 40 Internet Performance Index reached 4 seconds, compared to the more common range of 2-3 seconds. The average download had dropped to 3.2 seconds early this morning, but sites in the index began to show delays of up to 3.9 seconds by late morning, Keynote says.

In addition, Keynote says that the average number of pages available for the sites in the index dropped to 90% yesterday, compared to a usual availability of about 95%, but that availability began to rise again today.

comments powered by Disqus

Advertisement

Advertisement

Advertisement

From IR Blogs

FPO

Patrick Smarzynski / E-Commerce

What the changes at eBay mean for sellers

The online marketplace introduced new rules for sellers last month. It’s crucial that sellers understand ...

FPO

Mark Feinstein / E-Commerce

A quick guide to global e-commerce opportunities

Consumers in many countries are buying more online each year. Understanding the nuances of each ...

Advertisement