Web worm seen abating

Spencer Swartz

SAN FRANCISCO: A computer worm that over the last 24 hours disrupted some of the world's most popular sites, including Google, tapered off as computer users patched up their defenses, analysts said.

But computer security firms warned the MyDoom worm had left many computer systems vulnerable to follow-on attacks by allowing the mysterious author of the worm to go straight to MyDoom-infected computers in the future to launch other viruses rather than scan the Internet to find vulnerable systems.

Computer users can keep their systems protected from such attacks, sometimes referred to as "back-door" attacks, by regularly downloading anti-viral software updates from computer security companies like Symantec Corp. and McAfee Inc.

Another twist to Monday's MyDoom is that a new virus that began moving on the Internet on Tuesday is preying on systems infected by MyDoom to potentially bombard Microsoft Corp.'s Web site with messages sent from infected computers, according to Symantec.

Dee Liebenstein, group product manager for Symantec's security and response team, said the new virus, known as "zindos.a," was not spreading quickly and cautioned Microsoft's Web site was not at risk of being toppled by a flood of "hits" on the company's Web site. "At this point, there's no evidence Microsoft.com is in trouble," she said.

Microsoft, said in a statement, its network was "stable" and that it had taken steps to ensure Microsoft.com remains available to customers.

It added that Microsoft was working with Virus Information Alliance partners to help protect its system from the zindos virus.

ONLINE SEARCHES SEEN NORMAL

Liebenstein said Symantec was receiving about 30 reports an hour from customers on Tuesday about MyDoom, down from about 100 an hour when the worm was spreading fastest on Monday.

The online attack marked an evolution of MyDoom that infected hundreds of thousands of computers earlier this year.

In the current variant, MyDoom scans the hard drives of computer systems for e-mail addresses then turns to online search sites, like Google and Yahoo, to find additional leads.

Brian Nelson, a Yahoo spokesman, said the effect of MyDoom on the company's search engine had been "limited" due to the company's ongoing implementation of anti-virus security measures.

David Krane, a Google spokesman, said the company's online search engine returned to normal Monday afternoon after reports earlier in the day from around the world that Google searches were not returning results.

Brian Mann, a virus outbreak manager at McAfee, said the company was seeing about 10 reports an hour from clients on Tuesday about MyDoom, down from 50 reports to 60 reports an hour on Monday.

MessageLabs, a New York-based email security provider, said on Tuesday it had so far intercepted 599,641 copies of the latest MyDoom virus.

Mann said MyDoom was leaving computing systems exposed for future virus attacks but said he believed the rate at which MyDoom was doing this was "on-par" with other viruses in the past.

On Monday, McAfee said it expected 2004 to be a record year in terms of the total number of "successful" viruses and worms, due to smarter malicious code writers and the still-common practice of computer users opening virus-laden messages.

(Additional reporting by Wei Gu and Eric Auchard)