MyDoom.O, also known as MyDoom.M or MyDoom.M@mm, installs a Trojan known as Zincite.A on every PC that it infects. The Trojan opens TCP port 1034 and listens for further commands. Zindos spreads itself by scanning for machines listening on port 1034. When it finds one, Zindos copies itself to the infected PC and then Zincite executes the copy.
Zindos then creates an executable file and launches a DDoS attack against Microsoft Corp.s main Web site. Some earlier versions of MyDoom also attacked the companys site. Microsofts site appeared to be unaffected by the activity.
Analysts at Symantec Corp., based in Cupertino, Calif., said Tuesday that they had discovered a previously unknown function in MyDoom.O that keeps track of every system the worm infects.
After finding this, the analysts went back over the code from MyDoom.L and found that that variant contains the same feature. This led the team to conclude that the worms author may have used the machines infected by the L variant as a seeding ground for the latest version.
The author could have simply uploaded a copy of MyDoom.O to one of the PCs infected by MyDoom.L and instructed the worm to read the list of compromised machines. MyDoom.O then could have sent itself to all of those other PCs.
Symantec also said its analysts believe that Zindos is being used as an updating mechanism for the MyDoom worms, which means that their behavior and characteristics could change at any time.
Also Tuesday, e-mail security provider MessageLabs Inc. said it had seen more than 530,000 copies of MyDoom.O since its arrival late Sunday.
Be sure to add our eWEEK.com security news feed to your RSS newsreader or My Yahoo page: