Editing Mydoom

{{Short description|Self-replicating malware program that spread by email}}
{{Infobox computer virus
| image                = Mydoom text file.png
| caption              = Example of a randomly generated file opened by Mydoom after execution
| fullname             = Mydoom
| common_name          = Mydoom
| type                 = Computer worm
| discontinuation_date = {{ubl|12 February 2004 (Mydoom.A)|1 March 2004 (Mydoom.B)}}
| OSes                 = [[Windows 2000]], [[Windows XP]]
| language             = [[C++]]
}}

'''Mydoom''' was a [[computer worm]] that targeted computers running [[Microsoft Windows]]. It was first sighted on January 26, 2004. It became the fastest-spreading e-mail worm ever, exceeding previous records set by the [[Sobig worm]] and [[ILOVEYOU]], a record which as of 2025 has yet to be surpassed.<ref>{{Cite web |url = http://edition.cnn.com/2004/TECH/internet/01/28/mydoom.spreadwed/ |title = Security firm: MyDoom worm fastest yet |work = CNN.com |publisher = Time Warner |date = 2004-01-28 |access-date = 2007-10-14 |archive-date = 2007-11-14 |archive-url = https://web.archive.org/web/20071114133250/http://edition.cnn.com/2004/TECH/internet/01/28/mydoom.spreadwed/ |url-status = live }}</ref>

Mydoom appears to have been commissioned by e-mail [[spamming|spammers]] to send junk e-mail through infected computers.<ref>{{Cite web |url = http://seattletimes.nwsource.com/html/businesstechnology/2001859752_spamdoubles18.html |title = E-mail viruses blamed as spam rises sharply |author = Tiernan Ray |work = [[The Seattle Times]] |publisher = The Seattle Times Company |date = 2004-02-18 |access-date = 2004-02-19 |archive-date = 2012-08-26 |archive-url = https://web.archive.org/web/20120826193746/http://seattletimes.nwsource.com/html/businesstechnology/2001859752_spamdoubles18.html |url-status = live }}</ref> The worm contains the text message ''"Andy; I'm just doing my job, nothing personal, sorry,"'' leading many to believe that the worm's creator was paid. Early on, several security firms expressed their belief that the worm originated from a programmer in Russia. The actual author of the worm is unknown.

The worm appeared to be a poorly sent e-mail, and most people who originally were e-mailed the worm ignored it, thinking it was spam. However, it eventually spread to infect at least 500 thousand computers across the globe.<ref>{{Cite web |title=Mydoom threat still high;Microsoft offers reward |url=https://www.nbcnews.com/id/wbna4065701 |archive-url=https://web.archive.org/web/20210805160108/https://www.nbcnews.com/id/wbna4065701 |url-status=dead |archive-date=August 5, 2021 |access-date=2022-06-29 |website=NBC News |date=26 January 2004 |language=en}}</ref>

Speculative early coverage held that the sole purpose of the worm was to perpetrate a [[distributed denial-of-service attack]] against [[SCO Group]]. 25 percent of Mydoom.A-infected hosts targeted [[SCO Group]] with a flood of traffic. Trade press conjecture, spurred on by SCO Group's own claims, held that this meant the worm was created by a [[Linux]] or [[open source]] supporter in retaliation for SCO Group's controversial [[SCO v. IBM|legal actions]] and public statements against Linux. This theory was rejected immediately by security researchers. Since then, it has been likewise rejected by law enforcement agents investigating the virus, who attribute it to organized online crime gangs.

Mydoom was named by Craig Schmugar, an employee of computer security firm [[McAfee]] and one of the earliest discoverers of the worm. Schmugar chose the name after noticing the text "mydom" within a line of the program's code. He noted: "It was evident early on that this would be very big. I thought having 'doom' in the name would be appropriate."<ref>{{Cite web |url = http://www.newsweek.com/id/52912 |title = More Doom? |work = [[Newsweek]] |publisher = [[Washington Post Company]] |date = 2004-02-03 |access-date = 2007-10-28 |archive-date = 2009-03-02 |archive-url = https://web.archive.org/web/20090302181536/http://www.newsweek.com/id/52912 |url-status = live }}</ref>

==Technical overview==
Mydoom is primarily transmitted via [[e-mail]], appearing as a transmission error, with subject lines including "Error", "Mail Delivery System", "Test" or "Mail Transaction Failed" in different languages, including English and French. The mail contains an [[E-mail attachment|attachment]] that, if [[execution (computers)|executed]], resends the worm to e-mail addresses found in local files such as a user's address book. It also copies itself to the "shared folder" of [[peer-to-peer]] [[file sharing]] application [[Kazaa]] in an attempt to spread that way.

Mydoom avoids targeting e-mail addresses at certain universities, such as [[Rutgers University|Rutgers]], [[Massachusetts Institute of Technology|MIT]], [[Stanford University|Stanford]] and [[University of California, Berkeley|UC Berkeley]], as well as certain companies such as [[Microsoft]] and [[NortonLifeLock|Symantec]].  Some early reports claimed the worm avoids ''all'' [[.edu]] addresses, but this is not the case.

The original version, '''Mydoom.A''', is described as carrying two [[Payload (software)|payload]]s:

* A [[Backdoor (computing)|backdoor]] on [[TCP and UDP port|port]] 3127/tcp to allow remote control of the subverted PC (by putting its own SHIMGAPI.DLL file in the system32 directory and launching it as a [[child process]] of [[Windows Explorer]]); this is essentially the same backdoor used by [[Mimail]].
* A [[denial-of-service attack]] against the website of the [[SCO v. IBM|controversial]] company [[SCO Group]], timed to commence 1 February 2004. Many virus analysts doubted if this payload would actually function. Later testing suggests that it functions in only 25% of infected systems.<ref>{{Cite web |title=[Review] MyDoom Virus: The Most Destructive & Fastest Email Worm |url=https://www.minitool.com/backup-tips/mydoom-virus.html?amp |access-date=2023-10-12 |website=MiniTool}}</ref>

A second version, '''Mydoom.B''', as well as carrying the original payloads, also targets the Microsoft website and blocks access to Microsoft sites and popular online [[Antivirus software|antivirus]] sites by modifying the [[hosts file]], thus blocking virus removal tools or updates to antivirus software. The smaller number of copies of this version in circulation meant that Microsoft's servers suffered few ill effects.<ref>{{Cite web
|url      = http://news.bbc.co.uk/1/hi/technology/3459363.stm
|title      = Mydoom virus starts to fizzle out
|publisher      = BBC
|work      = BBC News
|date      = 2004-02-04
|access-date      = 2004-02-04
|archive-date      = 2004-04-16
|archive-url      = https://web.archive.org/web/20040416132835/http://news.bbc.co.uk/1/hi/technology/3459363.stm
|url-status      = live
}}</ref><ref>{{Cite web|url=https://abcnews.go.com/Technology/ZDM/story?id=97385|title=How to Thwart Renewed 'MyDoom' E-Mail Bug|website=[[ABC News (United States)|ABC News]] |access-date=2020-06-28|archive-date=2020-09-28|archive-url=https://web.archive.org/web/20200928232001/https://abcnews.go.com/Technology/ZDM/story?id=97385|url-status=live}}</ref>

==Timeline==
{{More citations needed section|date=June 2022}}
* '''26 January 2004:''' The Mydoom virus is first identified around 8am [[Eastern Standard Time Zone|EST]] (1300 UTC), just before the beginning of the workday in North America. The earliest messages originate from Russia. For a period of a few hours mid-day, the worm's rapid spread slows overall internet performance by approximately ten percent and average [[web page]] load times by approximately fifty percent. Computer security companies report that Mydoom is responsible for approximately one in ten e-mail messages at this time.
:Although Mydoom's Denial of Service (DoS) attack was scheduled to begin on 1 February 2004, [[SCO Group]]'s website goes offline briefly in the hours after the worm is first released. It is unclear whether Mydoom was responsible for this. SCO Group claimed it was the target of several [[distributed denial of service]] attacks in 2003 that were unrelated to computer viruses.
* '''27 January 2004:''' [[SCO Group]] offers a US$250,000 reward for information leading to the arrest of the worm's creator. In the US, the [[Federal Bureau of Investigation|FBI]] and the [[United States Secret Service|Secret Service]] begin investigations into the worm.
* '''28 January 2004:''' A second version of the worm is discovered two days after the initial attack. The first messages sent by Mydoom.B are identified at around 1400 UTC and also appear to originate from Russia. The new version includes the original denial of service attack against SCO Group and an identical attack aimed at Microsoft.com beginning on 3 February 2004; however, both attacks are suspected to be either broken, or non-functional decoy code intended to conceal the [[Backdoor (computing)|backdoor]] function of Mydoom. Mydoom.B also blocks access to the websites of over 60 computer security companies, as well as pop-up advertisements provided by [[DoubleClick]] and other online marketing companies.
:The spread of Mydoom peaks; computer security companies report that Mydoom is responsible for roughly one in five e-mail messages at this time.
* '''29 January 2004:''' The spread of Mydoom begins to decline as bugs in Mydoom.B's code prevent it from spreading as rapidly as first anticipated. Microsoft offers US$250,000 reward for information leading to the arrest of the creator of Mydoom.B.
* '''1 February 2004:''' An estimated one million computers around the world infected with Mydoom begin the virus's massive distributed denial of service attack&mdash;the largest such attack to date. As 1 February arrives in East Asia and Australia, SCO removes www.sco.com from the [[Domain Name System|DNS]] around 1700 [[UTC]] on 31 January. (There is as yet no independent confirmation of www.sco.com in fact suffering the planned DDOS.)
* '''3 February 2004:''' Mydoom.B's distributed denial of service attack on Microsoft begins, for which Microsoft prepares by offering a website which will not be affected by the worm, information.microsoft.com.<ref>{{Cite web|url=http://information.microsoft.com/security/antivirus/mydoom.asp |title=Microsoft Information: MyDoom (Wayback Archive from 4 Feb 2004) |work=microsoft.com |date=2004-02-04 |url-status=unfit |archive-url=https://web.archive.org/web/20040204005953/http://information.microsoft.com/security/antivirus/mydoom.asp |archive-date=February 4, 2004 }}</ref> However, the impact of the attack remains minimal and [http://www.microsoft.com www.microsoft.com] remains functional. This is attributed to the comparatively low distribution of the Mydoom.B variant, the high load tolerance of Microsoft's web servers and precautions taken by the company. Some experts point out that the burden is less than that of Microsoft software updates and other such web-based services.
* '''9 February 2004:''' Doomjuice, a “parasitic” worm, begins spreading. This worm uses the backdoor left by Mydoom to spread. It does not attack non-infected computers. Its payload, akin to one of Mydoom.B's, is a denial-of-service attack against Microsoft.<ref>{{Cite web
|url       = http://www.symantec.com/avcenter/venc/data/w32.hllw.doomjuice.html
|title       = W32.HLLW.Doomjuice
|publisher       = Symantec Corporation
|date       = 2007-02-13
|access-date       = 2004-02-10
|archive-date       = 2004-04-15
|archive-url       = https://web.archive.org/web/20040415023504/http://www.symantec.com/avcenter/venc/data/w32.hllw.doomjuice.html
|url-status       = dead
}}</ref>
* '''12 February 2004:''' Mydoom.A is programmed to stop spreading. However, the backdoor remains open after this date.
* '''1 March 2004:''' Mydoom.B is programmed to stop spreading; as with Mydoom.A, the backdoor remains open.
* '''26 July 2004:''' A variant of Mydoom attacks [[Google]], [[AltaVista]] and [[Lycos]], completely stopping the function of the popular Google search engine for the larger portion of the workday, and creating noticeable slow-downs in the AltaVista and Lycos engines for hours.
* '''23 September 2004:''' Mydoom versions U, V, W and X appear, sparking worries that a new, more powerful Mydoom is being prepared.
* '''18 February 2005:''' Mydoom version AO appears.
* '''July 2009:''' Mydoom resurfaces in the [[July 2009 cyber attacks]] affecting South Korea and the United States.<ref name="Lazy Hacker and Little Worm Set Off Cyberwar Frenzy">{{cite magazine|title=Lazy Hacker and Little Worm Set Off Cyberwar Frenzy|magazine=[[Wired News]]|date=2009-07-08|url=https://www.wired.com/threatlevel/2009/07/mydoom/|access-date=2009-07-09|archive-date=2009-07-10|archive-url=https://web.archive.org/web/20090710221733/http://www.wired.com/threatlevel/2009/07/mydoom/|url-status=live}}</ref>

==See also==
* [[Timeline of notable computer viruses and worms|Timeline of computer viruses and worms]]

==References==
{{Reflist}}

==External links==
* [https://web.archive.org/web/20070127224622/http://www.evilbitz.com/2006/12/09/an-intriguer-virus/ MyDoom and DDoS Attacks]
* {{Cite web
 |url         = https://www.google.com/search?q=memz+download&safe=active
|work        = Viruslist.com
 |publisher   = Kaspersky Lab
 |title       = Email-Worm.Win32.Mydoom.a
 |url-status     = dead
 |archive-url  = https://web.archive.org/web/20061015223552/http://www.viruslist.com/en/viruses/encyclopedia?virusid=22686
 |archive-date = 2006-10-15
}}
* [https://web.archive.org/web/20040715075646/http://ir.sco.com/ReleaseDetail.cfm?ReleaseID=127545 SCO Offers Reward for Arrest and Conviction of Mydoom Virus Author] - SCO press release, 27 January 2004. Note the claim that the denial of service attack had already started at this date.
* {{Cite web
|url = http://www.f-secure.com/v-descs/novarg.shtml
|title = Mydoom
|work = F-Secure Computer Virus Information Pages
|publisher = F-Secure Corporation
}}
* {{Cite web
|url = http://www3.ca.com/securityadvisor/virusinfo/virus.aspx?id=38102
|title = Win32.Mydoom.A
|work = Security Advisor
|publisher = Computer Associates International
|access-date = 2005-04-30
|archive-url = https://web.archive.org/web/20050410011944/http://www3.ca.com/securityadvisor/virusinfo/virus.aspx?ID=38102
|archive-date = 2005-04-10
|url-status = dead
}}
* [https://web.archive.org/web/20061110172812/http://www.symantec.com/security_response/writeup.jsp?docid=2004-012612-5422-99 Information about the Mydoom worm from Symantec.com]
* {{Cite web
|url = https://www.youtube.com/watch?v=cRH-khasTfg
|title = Computer Virus That Caused $50 Billion Damage
|publisher = The InfoGraphics Show YouTube Channel
}}

{{Hacking in the 2000s}}

[[Category:Computer worms]]
[[Category:Email worms]]
[[Category:Hacking in the 2000s]]
[[Category:2004 in computing]]
[[Category:Windows malware]]