MyDoom-A is programmed to stop spreading today, marking the end of arguably the worst email-borne viral epidemic to date. MessageLabs, the email filtering firm, blocked the virus 43,979,281 times in the two weeks since its first appearance in late January. At the height of the epidemic, one in 12 emails the firm scanned were viral. . . .
MyDoom-A is programmed to stop spreading today, marking the end of arguably the worst email-borne viral epidemic to date.

MessageLabs, the email filtering firm, blocked the virus 43,979,281 times in the two weeks since its first appearance in late January. At the height of the epidemic, one in 12 emails the firm scanned were viral.

At the height of the Sobig-F pandemic last August one in 17 emails scanned by MessageLabs were viral. MessageLabs has blocked 33 million copies of SoBig-F, so MyDoom-A is the worst virus in terms of sheer weight of numbers too.

MyDoom-A was programmed to launch a denial of service attack against https://landing.sco.com/ from infected machines. This - along with its spread - will cease today (see below for caveat*).

However the back door component of the virus has no time limit; it is still running on pox-ridden PCs.

Infected machines still need to be identified and decontaminated. This is doubly important because the recently-released Doomjuice worm uses this back door access to direct infected machines to packet Microsoft's Web site.

MyDoom-A infected anything between 400,000 and one million PCs, according to sundry estimates from AV firms. On Tuesday, Feb 10, 67,000 IP addresses were actively scanning to and from port 3127, the back door left open by MyDoom-A, according to the SANS Institute's Internet Storm Center. This suggests many users have cleaned up their act.