Users login

Create an account »

JOIN XATRIX

Users login

Home » Hacking News » Mytob writers creating a super bug

Mytob writers creating a super bug

by Nikola Strahija on June 6th, 2005 Variants of worm block users' access to security Web sites, making it hard to get help once infected


Virus writers responsible for the recent rash of Mytob worm variants could be working on creating a super worm, a security researcher warned. The "HellBot" group behind the Mytob worms write programming instructions in their code that mirror the way developers work, said a Sophos Security Consultant. "The only conclusion we can come up with is that they are working on a big super worm," Theriault said.

Since its discovery in February, the Mytob mass-mailing worm has spawned dozens of variants, each just slightly different, according to researchers. However, each variant turns off an infected machine's security settings and blocks the user's access to security Web sites, Theriault said.

This makes it difficult to get help once a machine has been infected, and Trojan programs accompanying the worms could leave a backdoor open for attack, she said. One recent version included spyware and adware, which could be used to reap monetary benefits, according to U.K. antivirus company Trend Micro.

Over 50 percent of the reported problems coming into Sophos over the last 24 hours have been about Mytob worms, Theriault said. Recent versions, discovered earlier in the week, include Mytob.bi, which poses as a message from an IT administrator, warning that the recipient's e-mail account is about to be suspended.

It scans the hard drive of an infected machine and sends copies of itself to e-mail addresses it finds in the Windows Address Book. It also prevents the machine from accessing several antivirus and security Web sites, and can open a random port, allowing a hacker to gain remote access.

While antivirus companies would normally have to update their software to guard against each new variant, the Mytob family is so close that multiple variants can be caught using generic definitions of the worm, Theriault said. However, users are advised to keep their antivirus software up-to-date.


Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »