MyDoom variant opens backdoor IRC channel

Security experts have warned of a newly intercepted worm spreading throughout Europe which allows hackers to take remote control of infected PCs.

MyDoom.BQ, also known as Mytob.ED, arrives as an attachment in an email claiming that the user's email system has been "locked" for security reasons.

Once the attachment is opened the worm harvests email addresses to send itself on, and installs a backdoor channel to IRC that allows remote control of the PC.

"The IRC 'bot' program allows a remote user to perform malicious commands, such as downloading or executing files, on an affected machine through IRC backdoors," said a spokeswoman for Trend Micro, which rates the worm a 'medium' threat.

"Gaining remote access to an affected system directly compromises system security and leaves victims at risk of further malicious attacks."

The worm also redirects attempts to log-on to antivirus websites, making it difficult to download fresh virus signature files. To defeat this users should download the definitions on a separate PC and transfer the files over.

See also:

Users warned on Sophos antivirus flaw

Security firm advises customers to ensure they have the latest version  11 May 2005

Virus writers resort to gorilla tactics

Monkey business hides Wurmark-k payload  10 May 2005

Possible DNS hack knocks out Google

Search engine and email service offline for short time on Saturday  09 May 2005

Firefox hit with new critical flaws

Holes could allow hackers to implant Trojan or key-logger  09 May 2005

New mobile malware wipes phones

Now they're getting nasty  06 Apr 2005

Security

The latest wave of cyber-crimes and acts of vandalism have demonstrated once again that many systems are still vulnerable to attack.  15 Apr 2004

Like this story? Spread the news by clicking below:

 del.icio.us     Digg this     reddit!