The third version of MyDoom, Mydoom.C or Doomjuice as it is popularly known, emerged on the Internet on Monday. MyDoom’s DoomJuice targeted Microsoft’s Web site, slowing down the software maker’s home page, but not resulting in the Deny of Service message that its creators were hoping for.

The latest and the newest variety in the parade, DoomJuice targets only those PCs, which have been affected with its earlier variants. DoomJuice, attempts to direct the re-infected PCs to attack Microsoft’s Web site.

Following this, Microsoft has also issued a warning to users about a critical flaw in most versions of its Windows OS that could be manipulated by DoomJuice.

Although, the software maker, currently has no cases of computers being affected, but has said that Windows NT, Windows 2000, Windows XP and Windows Server 2003 were at risk. The company has also offered software updates to fix up the defect, which has been rated as ‘critical’.

However, the spread of the current variant depends only on the number of PCs infected with MyDoom A, a reported number that could be anywhere between 500,000 to a million machines.

Here are some characteristics of the infected e-mails that contain the MyDoom virus (still being sent and clogging up email boxes):

The “From” address of the e-mail is typically spoofed.

Spoofing is when an e-mail is sent from an address that either does not exist or the owner of that address did not really send the e-mail.

The subject of the e-mail likely will be “test,” “hello,” “Error,” “Server Report” or “Mail Transaction Failed” along with a 30 kilobyte attachment.

The extension of the attached file will be either .zip, .exe, .pif, .cmd or .scr.

Comments Off