Experts: Standard virus protection best way to fight Mydoom

Jaikumar Vijayan   Today’s Top Stories    or  Other Spam, Malware and Vulnerabilities Stories  

Avoiding the Latest Phishing Attacks Computerworld presents a 100% free and online security event today! Client Security Podcast Intercept Spam & Viruses Spam Spikes: A Real Risk to Your Business What Every E-Business Should Know about SSL Security and Consumer Trust Sign up to receive Security Resource Alerts

January 28, 2004 (Computerworld) -- Companies that are following recommended practices relating to secure e-mail use should be largely protected against the Mydoom virus and its variants, experts said.
Despite the speed with which the e-mail-borne menace has proliferated since the first variant was discovered on Monday, there's nothing about Mydoom, so far, that can't be dealt with by using antivirus, e-mail filtering and intrusion-detection technologies.
Mydoom, which is also known as Shimgapi and Novarg, started spreading earlier this week and has quickly become the most virulent e-mail virus ever.
The virus arrives as an e-mail with an attachment that can have various names and extensions, including .exe, .scr, .zip and .pif. When the attachment is executed, the worm starts sending copies of itself to other e-mail addresses stored in the infected computer. The first version of the virus, now called Mydoom.A is designed to attack The SCO Group Inc.'s Web site. A newer variant, dubbed Mydoom.B, which began surfacing earlier today, is apparently designed to enable similar denial-of-service attacks against Microsoft Corp.'s Web site. The variant also includes a feature that blocks infected computers from accessing sites belonging to vendors of antivirus products.
Companies that filter out e-mail attachments or analyze the contents of attachments are unlikely to have been affected much, said Darwin Ammala, computer security engineer for Harris Corp.'s STAT network security unit.
Bruce Hughes, director of malicious code research at TruSecure Corp.'s ICSA Labs, said about 80% of the company's clients already filter out at least five attachments that are commonly used in e-mail attacks. The remaining companies filter out even more attachments as a precaution against e-mail attacks, he said.
"From all indications, corporations of a size large enough to afford antivirus [technologies] at the e-mail gateway were unaffected," said Russ Cooper, moderator of NT Bugtraq and an analyst at Reston, Va.-based TruSecure.
Even in cases where the virus might have managed to infiltrate desktops, "most corporations will either notice, or block, outbound SMTP during such a virus outbreak" to stop the virus from spreading, Cooper said.

Several companies said that, so far, they have escaped the virus unscathed.
Online Resources Corp., a Reston-based online bill processing firm, hasn't been touched by Mydoom as yet. "We were not infected," said Hugh McArthur, information security officer at the firm. "I attribute that to a combination of keeping our antivirus products, especially at the gateways, up to date, along with a strong user awareness program."
The company also uses more than one antivirus product to add an extra layer of protection and redundancy to its virus-detection efforts, McArthur said.
Edward York, chief technology officer at 724 Inc., an application service provider in Lompoc, Calif., also said he has had few problems dealing with Mydoom so far.
"It mildly affected us beginning on Sunday evening by way of network congestion only," York said. "No servers were infected. I quickly added some filters to our mail server to filter out most of it. We still get some attachments which somehow sneak through, but we are blocking about 90% of the incidents."
Baker Hill Corp., a Carmel, Ind.-based application service provider, saw about 50 of its systems infected by Mydoom before its antivirus vendor had a fix for the worm, said Eric Beasley, senior network manager at the company.
Even so, only one user actually clicked on the attachment to activate the worm, he said. An antivirus product installed on the user's desktop quickly detected the worm and alerted administrators, Beasley said.
Since then, Baker Hill has updated its antivirus signatures. Baker Hill also uses a service provider to scan all of its e-mail for spam and has seen no evidence of Mydoom since the provider began stripping out all e-mail attachments containing the worm, he said.
"We are pleasantly surprised by how little it has affected us so far," said Trey Miller, manager of telecom services at Vertis Inc., a Baltimore-based advertising and media services company.
Vertis uses virus-protection services from Postini Inc. and has so far seen little evidence of Mydoom on its internal network, Miller said.

Print this Story

Send Us Feedback

E-mail this Story

Digg this Story

Slashdot this Story

Mydoom Lesson: Take Proactive Steps to Prevent DDoS Attacks Microsoft deflecting Mydoom.B DoS attack Experts: Standard virus protection best way to fight Mydoom

SCO offers $250,000 reward for arrest of Mydoom worm author New e-mail worm breaks infection records

"This company's infrastructure group is running a disaster recovery exercise with a reluctant participant: an IT manager who's notorious as..." Read more... "It's IT Blogwatch: in which Mozilla's Firefox Web browser continues to gain market share, smashing records as it does so...." Read more... Read more Security posts or See all Blogs

Microsoft promises four patches next week Google gives away home-cooked Web application security scanner Storm botnet stages Fourth of July attacks More top stories...

Microsoft trumpets security additions in upcoming IE8 Apple cuts price of high-end SSD MacBook Air by $500 Ultrathin showdown: Apple MacBook Air vs. Lenovo ThinkPad X300 vs. Toshiba Portege R500

This old laptop: Revitalizing an aging notebook on the cheap All it takes is a couple hours and about $125 to breathe new life into an old laptop. Here's how. Bill Gates moves on Is Microsoft's Golden Age over? What are Gates' most memorable quotes? Find out in Computerworld's complete coverage of the end of the Bill Gates era at Microsoft. Five things you should never tell your boss There are some things your CIO definitely doesn't want to hear. Also don't miss the flipside, Five things you should always tell your boss. Hands-On: Firefox 3 fixes what's broke and keeps what's right With its latest version, Mozilla's browser continues to raise the bar for what Web browsers should be. Windows Vista A to Z Reviews, analyses, how-tos, visual tours, hot issues and predictions about Microsoft's new OS. More Continuing Coverage After 9/11: Homeland SecurityAsk a Premier 100 IT LeaderBlackBerry Legal BattleData Security BreachesElectronic VotingFirefoxH-1B VisasHP's Boardroom ScandalHandheld DevicesHurricane Katrina AftermathMicrosoft Legal IssuesMicrosoft's VistaOpen SourceRFID TechnologySCO's Linux FightSarbanes-Oxley ActSpamVoice Over IPWi-FiWindows Meta File VulnerabilityWindows XP Service Pack 3 IT Careers 2010 Four years from now, the IT field will be a vastly different place. Will you be ready? More Special Reports Premier 100 IT Leaders 2007 Best in Class2006 Computerworld Horizon Awards2006 Premier 100 IT Leaders2006 Salary Survey2007 Best Places to Work in IT2007 IT Forecast2007 Premier 100 IT Leaders40 Years of ComputerworldASPs, Take TwoBest Places to Work in IT 2003Best Places to Work in IT 2004Best Places to Work in IT 2005Best Places to Work in IT 2006Business Intelligence Home RunsBusiness Intelligence: Smarter BIBusiness Intelligence: The Future of BICRM Goes VerticalCRM: Sober CRMCareer Planning Guide 2005Careers: IT Profession 2010Computerworld Horizon Awards 2005Data Management: Mining for GemsData Management: Taming Data ChaosDevelopment: Hard-Workin' Web SitesDevelopment: New Tools New ChoicesDevelopment: The New World of Application DevelopmentDevelopment: The Web Services TsunamiDevelopment: Web Services HurdlesDisaster Recovery: Preparing for the WorstE-commerce Grows UpE-mail/Groupware: Big DecisionsFaces of Mobile ITForecast 2006Global MobileHardware: Multiple Cores, Multiple ChallengesHardware: On-Demand Un-HypedHardware: The Shape of Things to ComeHorizon Awards: 10 Cool Cutting Edge TechnologiesIT Management: Guide to Managing VendorsIT Management: Navigating Global ITIT Management: Recovery AheadIT Management: The Future of ITIT Management: The Resourceful Project ManagerInnovative Technology Awards 2004Management: Reinventing ITMicrosoft in TransitionMobile/Wireless Leaders and LaggardsMobile/Wireless: The Untethered WorkerMobile/Wireless: Tiny Gadgets, Huge CostsNetwork Management: Taking ControlNetworking: Turbulence Ahead!Networking: VoIP Goes MainstreamOperating Systems: In the Slow LaneOperating Systems: Linux Goes GlobalOperating Systems: Should You Nix Unix?Outsourcing: Offshore Buyer's GuideOutsourcing: Outsourcing DangersPremier 100 IT Leaders 2004 Best in ClassPremier 100 IT Leaders 2005 Best in ClassROI: Do the Math!Salary Survey 2003Salary Survey 2004Salary Survey 2005Security Action PlanSecurity: Compliance HeadachesSecurity: Proactive SecuritySecurity: Risk and RewardSecurity: Tips From Security ProsSouped-up SecurityStorage: Battling ComplexityStorage: Cheap & Secure Data StoresStorage: Stretching Your Storage DollarsStorage: The Lean Storage MachineStorage: The New Rules of StorageStorage: The Ultimate Backup GuideSupply Chain: Missing LinksSupply Chain: RFID Reality CheckThe Business of SecurityWeb 2.0 SecurityWireless: Wireless At Work All Zones Application Performance Zone Business Continuity Zone Data Center Management Zone Enterprise-Class Security Zone The File Data Management Zone Grid Computing on Windows Zone Security Management Zone ITIL Best Practices Zone The SAS Zone Storage Virtualization Zone Business Intelligence and Analytics Zone See your link here

Why SaaS is Vital to Email and Web Security Why SaaS is Vital to Email and Web Security Download this webcast, free, compilments of Webroot Software Go to the webcast  Managing Mobile Data with Endpoint Security for Laptops Download this white paper now, compliments of Computerworld and Absolute Software. (Source: Absolute Software) A NetworkWorld survey of IT professionals found that only 1 in 100 employees consistently follow data security policy. This paper outlines endpoint security for laptops that restricts data access beyond encryption to safeguard against insider threats and user error. Read this whitepaper to learn lessons from recent data breaches, limitations of traditional data security, and how to remotely wipe out data and monitor computers that go off the network. Download this executive briefing  Top 10 Reasons to Upgrade Get this white paper now! (Source: Symantec) Symantec Backup Exec 12 and Backup Exec System Recovery 8 deliver industry leading Windows data protection and system recovery. Download this whitepaper to find out the top reasons to upgrade and how to get continuous data protection and complete system recovery. Download this white paper  White Papers Read up on the latest ideas and technologies from companies that sell hardware, software and services. Deploying Virtualized NetWare on Linux Whitepaper Toward More Flexible, Next-Generation Collaboration Solutions Driving Business Success Through Workgroup Choice and Flexibility View more whitepapers

• Mydoom Lesson: Take Proactive Steps to Prevent DDoS Attacks
• Microsoft deflecting Mydoom.B DoS attack
• Experts: Standard virus protection best way to fight Mydoom
• SCO offers $250,000 reward for arrest of Mydoom worm author
• New e-mail worm breaks infection records

• Microsoft promises four patches next week
• Google gives away home-cooked Web application security scanner
• Storm botnet stages Fourth of July attacks
• More top stories 

Try Fluke Networks' EtherScope Analyzer on your network FREE Quickly solve the wide range of problems you encounter - 10, 100 and Gigabit, twisted pair and optical fiber, LAN or wireless LAN. The EtherScope Analyzer combines the essential tools you need to monitor network traffic and switch interfaces, discover devices, networks, VLANs, access points, mobile clients and more. See the power of this portable network analyzer on your network. Request free trial now *Terms and conditions: Evaluation units are available only for a limited time and will be scheduled on a first-come first-served basis. Not available in all geographies. Limited quantities available; customers requesting evaluation units may be waitlisted for the next available unit. It will be at the discretion of Fluke Networks to accept or decline requests for this free evaluation.