Mydoom worm propagation speed down
“Mydoom.a” since January 27, the worm spread rapidly, but the worm at startup determines local time, if greater than February 12, 2004 the termination. However, the worms will still be loaded Explorer.exe left by the back door, back door will remain, to leave a serious hidden dangers of the Internet.
As of February 13, 12:00,CNCERT/CC has sample monitoring to send messages with worm 3357duowanci, mainland China has more than 230,000 multiple hosts infected with the worm. Under the CNCERT/CC results of the monitoring, on February 13 hosts have been significantly reduced number of worm propagation and infection, slight decline in Internet traffic to port 25, but still higher than normal levels.
Worm didn’t disappear completely, because the worm determines only at the beginning of the run time, only the infected worm worms will stop after a restart of the host to send mail or attack on www.SCO.com site. On February 13 and after running worms, still continue to spread.
CNCERT/CC are continuing to pay close attention to the situation of the worm.
News source: the national computer network emergency treatment Coordination Center