MyDoom.B Is For Bust

It looked like a slam-dunk. MyDoom.A spread around the Internet like a cold through day care, and MyDoom.B was supposed to find those systems and upgrade them. Why is MyDoom.B a flop? Happy days in Redmond.

The rapid spread of MyDoom.A was a pretty scary thing to witness. I knew that I had immediately recognized it as a worm when it showed up here, but still its scary when so many people out there get infected. Then MyDoom.B came out and I really got concerned, partly because of its evil practice of locking users out of accessing security sites from which they might disinfect themselves.

MyDoom.B seemed like a slam-dunk to spread far and fast. Apart from the usual mass-mailing and KaZaA-based propagation methods, it also searches the Internet for systems with the MyDoom.A backdoor installed (and it uses a really weird method of scanning for those systems, skipping many of them for no apparent reason). When it finds a system running the backdoor, it sends it a copy of MyDoom.B for installation.


In the abstract, this should be the right way to do it, and youd think that with an ecosystem so fertile with MyDoom.A infestations, that B would be all over the place. Such is emphatically not the case. I searched the analyses of the MyDoom.B virus on the Web sites of several security firms. I found little reason for fear; the technical descriptions are all pretty scary, but almost all of those sites with an assessment of how far it has spread classify that spread as "little or none." Heres a handy list for your own inspection:

Interesting that even though there was a lot of disagreement on the name of the A variant (MyDoom.A, Novarg.A, MiMail.R, etc.) they all call the B variant MyDoom.B.

The only company that rates it anything above nothing is F-Secure, a company thats done a bit of scaremongering in the past. But "LEVEL 2" indicates less than it may seem, since the next lowest level of severity, LEVEL 3, describes a virus not necessarily in the wild. In other words, their levels and descriptions are not sufficiently granular.

Next page: So what will happen on Feb. 3?