New Virus Exploits MyDoom Success

According to a story published by the BBC, a new virus called Zindos has been released and is piggybacking on the spread of MyDoom.O, the virus that brought down several search engines yesterday. However, this new virus is programmed to visit Microsoft's homepage every 50 milliseconds instead of bring down search sites.

MyDoom.O, also called MyDoom.M, hit the headlines because of the trick it used to look for new victims to infect. Instead of just plundering Microsoft Outlook address books, the virus also went online to search for other e-mail addresses with the same suffix.

MyDoom.O Subject Lines hi Delivery failed Message could not be delivered Mail System Error - Returned Mail Delivery reports about your e-mail Returned mail: see transcript for details Returned mail: Data format error instruction MAILER-DAEMON "Mail Administrator" "Automatic Email Delivery Software" "Post Office" "The Post Office" "Bounced mail" "Returned mail" "Mail Delivery Subsystem"

As well as searching the net for new addresses and looking for new hosts to infect, MyDoom.O also opened up a backdoor on compromised machines. This backdoor is now being exploited by the follow-up Zindos virus which is spreading rapidly through those machines still hosting the MyDoom.O bug. Once installed Zindos scours connections looking for other vulnerable machines. Once it finds one, starts bombarding Microsoft.com with requests.

So far Zindos has not spread widely and security experts speculate that it has been released simply to cash in on the success of MyDoom.O. The Microsoft.com website has yet to show any sign that it is struggling to cope with the hits generated by Zindos.

MyDoom.O's search engine trick and attempts to piggy back on successful infections to boost its own chances of spreading widely may herald a new variety of viruses which spread through search engines.

The worms affect Windows systems but not Linux or Apple Macintosh computers.