MyDoom

**Mydoom**, also known as **W32.MyDoom@mm**, **Novarg**, **Mimail.R** and **Shimgapi** is a computer worm affecting Microsoft Windows. It was first sighted on January 26, 2004. It became the fastest-spreading e-mail worm ever (as of January 2004), exceeding previous records set by the Sobig worm and ILOVEYOU.

Mydoom appears to have been commissioned by e-mail spammers so as to send junk e-mail through infected computers. The worm contains the text message *"andy; I'm just doing my job, nothing personal, sorry,"*
 leading many to believe that the worm's creator was paid. Early on,
several security firms expressed their belief that the worm originated
from a programmer in Russia. The actual author of the worm is unknown.

Speculative early coverage held that the sole purpose of the worm was to perpetrate a distributed denial-of-service attack against SCO Group. 25 percent of Mydoom.A-infected hosts targeted www.sco.com with a flood of traffic. Trade press conjecture, spurred on by SCO
Group's own claims, held that this meant the worm was created by a Linux or open source supporter in retaliation for SCO Group's controversial legal actions
 and public statements against Linux. This theory was rejected
immediately by security researchers. Since then, it has been likewise
rejected by law enforcement agents investigating the virus, who
attribute it to organized online crime gangs.

## Timeline

* **26 January 2004:** The Mydoom virus is first identified around 8am EST

 (1300 UTC), just before the beginning of the workday in North America.
The earliest messages originate from Russia. For a period of a few hours
 mid-day, the worm's rapid spread slows overall internet performance by
approximately ten percent and average web page
 load times by approximately fifty percent. Computer security companies
report that Mydoom is responsible for approximately one in ten e-mail
messages at this time.

Although Mydoom's denial of service attack was scheduled to begin on 1 February 2004, SCO Group's
 website goes offline briefly in the hours after the worm is first
released. It is unclear whether Mydoom was responsible for this. SCO
Group claimed it was the target of several distributed denial of service attacks in 2003 that were unrelated to computer viruses.

* **27 January:** SCO Group offers a US $250,000 reward for information leading to the arrest of the worm's creator. In the US, the FBI and the Secret Service begin investigations into the worm.
* **28 January:** A second version of the worm is discovered two

days after the initial attack. The first messages sent by Mydoom.B are
identified at around 1400 UTC and also appear to originate from Russia.
The new version includes the original denial of service attack against
SCO Group and an identical attack aimed at Microsoft.com beginning on 3
February 2004; however, both attacks are suspected to be either broken,
or non-functional decoy code intended to conceal the backdoor
 function of Mydoom. Mydoom.B also blocks access to the websites of over
 60 computer security companies, as well as pop-up advertisements
provided by DoubleClick and other online marketing companies.

The spread of MyDoom peaks; computer security companies report that
Mydoom is responsible for roughly one in five e-mail messages at this
time.

* **29 January:** The spread of Mydoom begins to decline as bugs in

 Mydoom.B's code prevent it from spreading as rapidly as first
anticipated. Microsoft offers US $250,000 reward for information leading
 to the arrest of the creator of Mydoom.B.

* **1 February 2004:** An estimated one million computers around

the world infected with Mydoom begin the virus's massive distributed
denial of service attack—the largest such attack to date. As 1 February
arrives in East Asia and Australia, SCO removes www.sco.com from the DNS around 1700 UTC on 31 January. (There is as yet no independent confirmation of www.sco.com in fact suffering the planned DDOS.)

* **3 February:** Mydoom.B's distributed denial of service attack

on Microsoft begins, for which Microsoft prepares by offering a website
which will not be affected by the worm, information.microsoft.com. However, the impact of the attack remains minimal and www.microsoft.com
 remains functional. This is attributed to the comparatively low
distribution of the Mydoom.B variant, the high load tolerance of
Microsoft's web servers and precautions taken by the company. Some
experts point out that the burden is less than that of Microsoft
software updates and other such web-based services.

* **9 February:** Doomjuice,

 a “parasitic” worm, begins spreading. This worm uses the backdoor left
by Mydoom to spread. It does not attack non-infected computers. Its
payload, akin to one of Mydoom.B's, is a denial-of-service attack
against Microsoft.

* **12 February:** Mydoom.A is programmed to stop spreading. However, the backdoor remains open after this date.
* **1 March:** Mydoom.B is programmed to stop spreading; as with Mydoom.A, the backdoor remains open.
* **26 July:** A variant of Mydoom attacks Google, AltaVista and Lycos,

 completely stopping the function of the popular Google search engine
for the larger portion of the workday, and creating noticeable
slow-downs in the AltaVista and Lycos engines for hours.

* **10 September:** MyDoom versions U, V, W and X appear, sparking worries that a new, more powerful MyDoom is being prepared.
* **18 February 2005:** MyDoom version AO appears.
* **July 2009:** MyDoom resurfaces in the July 2009 cyber attacks affecting South Korea and the United States.