1. MyDoom By: Philippe Bissohong

2. Background ► MyDoom  W32.MyDoom@mm, Novarg, Mimail.R and Shimgapi ► Computer worm, unlike a virus it attacks a network and does not need to be attach to a software. ► Discovered by Craig Schmugar, a McAfee employee. ► Source unknown  Deliberate act of sabotage or vandalism against SCO Group  Most likely a Linux or an open source supporter retaliating against SCO group law suit and public statement against Linux

3. TIMELINE ► January 26, 2004: Fastest spreading email worm. ► February 1, 2004: With millions of computer affected, begins the Distributed denial of service attack against SCO Group. ► February 2, 2004: SCO Group move their site to a different address ► February 3, 2004: Beginning of Distributed denial of service attack against Microsoft. But Microsoft remains functional. ► February 12, 2004: MyDoom is programmed to stop spreading but the infected files remains on your computer. ► July 26, 2004: A MyDoom deviation shut down Google and slow down other search engine like AltaVista and Lycos.

4. MALWARE ► Program to send a flood of traffic to a specific host for a period of time ► When executed, it copied itself in the window system folder, leaving a back door to hackers for remote control of your system. ► Add an entry in the registry so it is activated every time window starts up ► Block HTTP access to certain site like Microsoft and other popular antivirus sites. Preventing update to anti-virus software or download of removal tools.

5. TRANSMISSION ► Mainly transmitted via email  From: Spoof sender that looks like somebody you might know.  Subject : "Error", "Mail Delivery System", "Test" or "Mail Transaction Failed"  Message: Blank or random error messages.  Include Attachment ► If executed, steals your email addresses and also generates random email to resend the worm. ► Also transmitted through peer to peer(P2P) file sharing. (kazaa)  Sneak in your share folder with the effort of spreading that way.

6. UNDER CONTROL ► Various things were done to keep the attack under control  Alternative addresses were created by SCO Group and Microsoft.  Disinfection tools were created to detect and remove MyDoom.  Worm expired on his own after February 12.  Anti-virus softwares updated their software.  $250,000 reward was offer for information leading to the worm creator.

7. LESSON ► Install and Enable a Firewall. ► Install and maintain your anti-virus software up- to-date. ► Make sure your anti-virus checks every files that is open. ► Install security updates. ► Never download, install or run an attachment unless you trust the sender. ► When in doubt or already infected, seek help immediately.

8. SOURCES ► F-Secure internet security  http://www.f-secure.com/v-descs/novarg.shtml http://www.f-secure.com/v-descs/novarg.shtml ► Wikipedia  http://en.wikipedia.org/wiki/Mydoom http://en.wikipedia.org/wiki/Mydoom ► Sophos  http://www.sophos.com/virusinfo/analyses/w32mydoom a.html

9. THE END