Mar 19, 2022
6 min read
MyDoom is a computer worm affecting Windows devices. It’s considered to be one of the fastest-spreading malicious types of software in history and has infected millions of computers worldwide since its launch in 2004. Here’s what you need to know about MyDoom.
While many people call it a virus, technically MyDoom is a worm, as it can operate and spread independently from the host.
MyDoom (also known as Novarg, W32.MyDoom@mm, Shimgapi, and Mimail.R) spreads through malicious email attachments. After the victim clicks on the attachment, the worm gets inside their operating system and sends emails to all the victim’s contacts. When people see a familiar name, they are more likely to open a suspicious file.
At the time of discovery in 2004, you could also get MyDoom by using the file-sharing platform Kazaa, which is no longer operating.
MyDoom adds infected computers to a botnet and then carries out distributed denial of service (DDoS) attacks. When the worm takes control over the victim’s OS, it then opens various ports and provides a backdoor to invite even more malware in.
MyDoom arrives with one of the following subject lines: test, hi, hello, mail delivery system, mail transaction failed, server report, status, or error. According to cybersecurity experts, the malicious email attachments typically contain pif, scr, exe, cmd, bat, htm, txt, doc, and zip extensions.
When MyDoom is executed, it copies itself to the %system% or %temp% directories. The worm also creates a registry value in one of the following keys:
This causes the worm to start whenever you launch your Windows computer. MyDoom also deploys a backdoor Trojan, allowing unauthorized access to your system, and copies itself to P2P to spread through downloads. After all of this is done, an infected device turns into a so-called zombie — a remotely controlled machine that can be used in DDoS attacks.
The first version of MyDoom was called MyDoom.A, followed by MyDoom.B, which additionally modified the host file of an infected computer to prevent the use of antimalware software.
However, MyDoom.B did not spread as fast as the previous variant. When it launched a DDoS attack against Microsoft in 2004, the botnet was not big enough to take down the site.
A bunch of other MyDoom variants – C, F, G/H, U, V, W, X – were spotted in the wild later, but none achieved the notoriety of the A variant.
MyDoom was first spotted on January 26, 2004, when internet users around the world started to get emails with a suspicious attachment. Most people in those days didn’t have a clue about phishing emails, social engineering, or hacking attacks. No wonder many of them clicked on a link and helped spread MyDoom like wildfire.
The malicious email contained the message “I’m just doing my job, nothing personal, sorry.” The spread of MyDoom was so fast that it slowed the global internet by ten percent on the day of its launch. One in ten email messages in the world at the time of the attack was associated with this notorious worm.
On January 28, MyDoom reached its peak and then started to slowly decline. However, the virus was slowed down not by cybersecurity experts but by its developers, as variant B had bugs.
On January 26, MyDoom took down Google, preventing people from using Google Search. Another popular search engine, Yahoo, was slowed down but managed to keep operating.
MyDoom also blocked access to websites of over 60 security companies, so users couldn’t download antivirus software to clean their computers. Tech industry leaders like Microsoft offered a $250,000 bounty to anyone who could track down the attackers. However, the culprits were never found.
Estimates say that MyDoom caused $38 billion in damages, making it one of the worst viruses ever. Security researchers believe MyDoom has infected around 50 million computers worldwide.
While more than 18 years have passed since the launch of MyDoom, the worm is still active and running. However, it is contained in just over 1% of malicious emails worldwide, mostly those sent by spammers originating from China and the US.
MyDoom hasn’t changed its tactics throughout the years: once the worm infects a computer, it starts searching for other email addresses through which to distribute itself.
If you have a feeling that your computer may be infected with MyDoom or any other type of malware, pay attention to its performance. However, MyDoom is considered to be a sophisticated worm, so it can be hard to notice any difference for non-professionals. Here’s what you need to look for:
More attentive readers can also check for specific signs attributed to MyDoom:
Want to read more like this?
Get the latest news and tips from NordVPN.
Trending articles
