Earl Monroe

Earl Vernon Monroe (born on November 21, 1944, in Philadelphia, Pennsylvania), was an American professional basketball player known for his flamboyant dribbling, passing and play-making. Schmugar chose the name after noticing the text "mydom" within a line of the program's code. Basketball Hall of Fame profile. Mydoom was named by Craig Schmugar, an employee of computer security firm McAfee and one of the earliest discoverers of the worm. Later analyses were less conclusive as to the link between the two worms. Initial analyses of Mydoom suggested that it was a variant of the Mimail worm — hence the alternate name Mimail.R — prompting speculation that the same persons were responsible for both worms.

[3]. Since then, it has been likewise rejected by law enforcement agents investigating the virus, who attribute it to organized online crime gangs. This theory was rejected out of hand by security researchers. Trade press conjecture, spurred on by SCO Group's own claims, held that this meant the worm was created by a Linux or open source supporter in retaliation for SCO Group's controversial legal actions and public statements against Linux.

25% of Mydoom.A-infected hosts targeted www.sco.com with a flood of traffic. Speculative early coverage held that the sole purpose of the worm was to perpetrate a distributed denial-of-service attack against SCO Group. [2] The actual author of the worm is unknown. Early on, several security firms published their belief that the worm originated from a professional underground programmer in Russia.

Mydoom appears to have been commissioned by e-mail spammers so as to send junk e-mail through infected computers.[1] The worm contains the text message "andy; I'm just doing my job, nothing personal, sorry," leading many to believe that the worm's creator was paid to create it. It became the fastest spreading email worm ever (as of January 2004), exceeding previous records set by the Sobig worm. It was first sighted on January 26, 2004. Mydoom, also known as Novarg, Mimail.R and Shimgapi, is a computer worm affecting Microsoft Windows.

18 February 2005: MyDoom version AO appears. 10 September: MyDoom versions U, V, W and X appear, sparking worries that a new, more powerful MyDoom is being prepared. 26 July: A variant of Mydoom attacks Google, AltaVista and Lycos, completely stopping the function of the popular Google search engine for the larger portion of the workday, and creating noticeable slow-downs in the AltaVista and Lycos engines for hours. 1 March: Mydoom.B is programmed to stop spreading; as with Mydoom.A, the backdoor remains open.

However, the backdoor remains open after this date. 12 February: Mydoom.A is programmed to stop spreading. Its payload, akin to one of Mydoom.B's, is a denial-of-service attack against Microsoft. It does not attack non-infected computers.

[7] This worm uses the backdoor left by Mydoom to spread. 9 February: Doomjuice, a "parasitic" worm, begins spreading. Some experts point out that the burden is less than that of Microsoft software updates and other such web-based services. This is attributed to the comparatively low distribution of the Mydoom.B variant, the high load tolerance of Microsoft's web servers and precautions taken by the company.

However, the impact of the attack remains minimal and www.microsoft.com remains functional. 3 February: Mydoom.B's distributed denial of service attack on Microsoft begins, for which Microsoft prepares by offering a website which will not be affected by the worm, information.microsoft.com. 2 February: The SCO Group moves its site to www.thescogroup.com. (There is as yet no independent confirmation of www.sco.com in fact suffering the planned DDOS.).

As 1 February arrives in East Asia and Australia, SCO removes www.sco.com from the DNS around 1700 UTC on 31 January. 1 February 2004: An estimated one million computers around the world infected with Mydoom begin the virus's massive distributed denial of service attack—the largest such attack to date. Microsoft offers US $250,000 reward for information leading to the arrest of the creator of Mydoom.B. 29 January: The spread of Mydoom begins to decline as bugs in Mydoom.B's code prevent it from spreading as rapidly as first anticipated.

Mydoom.B also blocks access to the websites of over 60 computer security companies, as well as pop-up advertisements provided by DoubleClick and other online marketing companies. The new version includes the original denial of service attack against SCO Group and an identical attack aimed at Microsoft.com beginning on 3 February 2004 — though both attacks are suspected to be either broken, or non-functional decoy code intended to conceal the backdoor function of Mydoom. The first messages sent by Mydoom.B are identified at around 1400 UTC and also appear to originate from Russia. 28 January: A second version of the worm is discovered two days after the initial attack.

In the US, the FBI and the Secret Service begin investigations into the worm. 27 January: SCO Group offers a US $250,000 reward for information leading to the arrest of the worm's creator. Computer security companies report that Mydoom is responsible for approximately one in ten e-mail messages at this time. For a period of a few hours mid-day, the worm's rapid spread slows overall internet performance by approximately ten percent and average web page load times by approximately fifty percent.

The earliest messages originate from Russia. 26 January 2004: The Mydoom virus is first identified around 8am EST (1300 UTC), just before the beginning of the workday in North America. Later testing suggests that it functions in only 25% of infected systems. Many virus analysts doubted if this payload would actually function.

A denial of service attack against the website of the controversial company SCO Group, timed to commence 1 February 2004. A backdoor on port 3127/tcp to allow remote control of the subverted PC (by putting its own SHIMGAPI.DLL file in the system32 directory and launching it as a child process of the Windows Explorer); this is essentially the same backdoor used by Mimail.