Mydoom.c
Doomjuice is out in the wild, infecting boxen who have been infected with mydoom.a. Nice.
This one isn't actually that bad, it doesn't spread via email and it doesn't seem to create any backdoors. It essentially just scans for machines that have been infected with mydoom.a (port 3127), installs itself, and then randomly hits on microsoft.com.
A Microsoft spokesman said Monday that "any performance problems on the company's site are likely related to countermeasures the company took to evade the MyDoom.B DDoS attack and not an attack from machines infected with the latest variant."
That's odd. Virus hits the wild Sunday, microsoft.com has "troubling performance" sunday night and monday morning, yet the theoretical cause are changes made to protect against mydoom.b?
Hmmmm.
Posted by drunkenbatmanFebruary 09, 2004, at 05:37 PM
