Mytob Mania Won't Stop

Welcome Guest. | Log In| Register | Membership Benefits

June 17, 2005 (2:36 PM EDT)

By Gregg Keizer , TechWeb Technology News

The Mytob worm family keeps popping out newborns, security firms noted Friday, with no signs that the variants will stop any time soon.

The Mytob worm, which first appeared in late February, is a mass-mailed worm that hijacks addresses from compromised PCs to spread using its own SMTP engine, drops a backdoor Trojan so more malicious code can be added to the infected system, tries to shut down security software already on the computer, and blocks access to a large number of security and update-oriented Web sites.

Security firms such as Symantec have tracked and labeled over 130 different variations on the Mytob worm in the last three-and-a-half months. So many variants have appeared, using so many different techniques -- including phishing-style tactics -- that some analysts believe the group responsible is crafting a "super" worm.

In the last 7 days, Symantec's identified 19 different Mytobs, an average of 2.7 new variants per day, an unheard-of number.

"In the last 24 hours, the Mytob family has accounted for 58 percent of all [virus] reports," the U.K.-based to Sophos said in a statement. Fourteen of the top 20 threats, Sophos added, were Mytob variants.

"There is nothing to suggest that the slew of Mytobs is tailing off," said Carole Theriault, a senior security consultant at Sophos.

Although most Mytob variants propagate via e-mail, some -- including several launched in June -- scan the Net for PCs vulnerable to a variety of Windows vulnerabilities, such as the LSASS bug that Microsoft patched more than a year ago.

One such vulnerability-sniffing Mytobs -- dubbed Mytop.ea by Symantec -- now accounts for fully 15 percent of all malicious code processed by Sophos, said Theriault.

"Patching against operating system vulnerabilities has never been more important. Users want to ensure that their barriers are up and ready to thwart these beasties," she added.