Editing Mydoom (section)

{{Short description|Self-replicating malware program that spread by email}}
{{Infobox computer virus
| image                = Mydoom text file.png
| caption              = Example of a randomly generated file opened by Mydoom after execution
| fullname             = Mydoom
| common_name          = Mydoom
| type                 = Computer worm
| discontinuation_date = {{ubl|12 February 2004 (Mydoom.A)|1 March 2004 (Mydoom.B)}}
| OSes                 = [[Windows 2000]], [[Windows XP]]
| language             = [[C++]]
}}

'''Mydoom''' was a [[computer worm]] that targeted computers running [[Microsoft Windows]]. It was first sighted on January 26, 2004. It became the fastest-spreading e-mail worm ever, exceeding previous records set by the [[Sobig worm]] and [[ILOVEYOU]], a record which as of 2025 has yet to be surpassed.<ref>{{Cite web |url = http://edition.cnn.com/2004/TECH/internet/01/28/mydoom.spreadwed/ |title = Security firm: MyDoom worm fastest yet |work = CNN.com |publisher = Time Warner |date = 2004-01-28 |access-date = 2007-10-14 |archive-date = 2007-11-14 |archive-url = https://web.archive.org/web/20071114133250/http://edition.cnn.com/2004/TECH/internet/01/28/mydoom.spreadwed/ |url-status = live }}</ref>

Mydoom appears to have been commissioned by e-mail [[spamming|spammers]] to send junk e-mail through infected computers.<ref>{{Cite web |url = http://seattletimes.nwsource.com/html/businesstechnology/2001859752_spamdoubles18.html |title = E-mail viruses blamed as spam rises sharply |author = Tiernan Ray |work = [[The Seattle Times]] |publisher = The Seattle Times Company |date = 2004-02-18 |access-date = 2004-02-19 |archive-date = 2012-08-26 |archive-url = https://web.archive.org/web/20120826193746/http://seattletimes.nwsource.com/html/businesstechnology/2001859752_spamdoubles18.html |url-status = live }}</ref> The worm contains the text message ''"Andy; I'm just doing my job, nothing personal, sorry,"'' leading many to believe that the worm's creator was paid. Early on, several security firms expressed their belief that the worm originated from a programmer in Russia. The actual author of the worm is unknown.

The worm appeared to be a poorly sent e-mail, and most people who originally were e-mailed the worm ignored it, thinking it was spam. However, it eventually spread to infect at least 500 thousand computers across the globe.<ref>{{Cite web |title=Mydoom threat still high;Microsoft offers reward |url=https://www.nbcnews.com/id/wbna4065701 |archive-url=https://web.archive.org/web/20210805160108/https://www.nbcnews.com/id/wbna4065701 |url-status=dead |archive-date=August 5, 2021 |access-date=2022-06-29 |website=NBC News |date=26 January 2004 |language=en}}</ref>

Speculative early coverage held that the sole purpose of the worm was to perpetrate a [[distributed denial-of-service attack]] against [[SCO Group]]. 25 percent of Mydoom.A-infected hosts targeted [[SCO Group]] with a flood of traffic. Trade press conjecture, spurred on by SCO Group's own claims, held that this meant the worm was created by a [[Linux]] or [[open source]] supporter in retaliation for SCO Group's controversial [[SCO v. IBM|legal actions]] and public statements against Linux. This theory was rejected immediately by security researchers. Since then, it has been likewise rejected by law enforcement agents investigating the virus, who attribute it to organized online crime gangs.

Mydoom was named by Craig Schmugar, an employee of computer security firm [[McAfee]] and one of the earliest discoverers of the worm. Schmugar chose the name after noticing the text "mydom" within a line of the program's code. He noted: "It was evident early on that this would be very big. I thought having 'doom' in the name would be appropriate."<ref>{{Cite web |url = http://www.newsweek.com/id/52912 |title = More Doom? |work = [[Newsweek]] |publisher = [[Washington Post Company]] |date = 2004-02-03 |access-date = 2007-10-28 |archive-date = 2009-03-02 |archive-url = https://web.archive.org/web/20090302181536/http://www.newsweek.com/id/52912 |url-status = live }}</ref>