MyDoom-ed PCs still prey to hackers

Raimund Genes, President of European Operations at Trend Micro told us: 'We know for sure that the DLL plant shimgapi.dll opens a backdoor on infected machines. The DOS attacks are programmed to stop after 12 February, but the backdoor remains open. Strangely, after 12 February new infections of MyDoom don't install the backdoor, but we don't know whether this is a deliberate act on the part of the writer or unintentional.

'But, some antivirus companies don't do a proper job. Some of the virus definitions released delete the bomb [the DOS component] but not the backdoor.'

Although he did not name names as to which vendors may be guilty, there are other ways that the machines may remain infected. While MessageLabs - a UK company that secures corporate email - first picked up the virus at 13:05hrs GMT on 26 January, vendors of desktop antivirus products didn't release new virus definitions for their customers to update their systems until several hours later.

http://www.pcpro.co.uk/?http://www.pcpro.co.uk/news/news_story.php?id=53412