TippingPoint's UnityOne Intrusion Prevention Systems Block Variant of `MyDoom' Virus.

Business Editors/High-Tech Writers

AUSTIN, Texas--(BUSINESS WIRE)--Jan. 30, 2004

TippingPoint Technologies Inc. (Nasdaq:TPTI), the leaders in high-speed intrusion prevention, today announced that the UnityOne Intrusion Prevention Systems provide network-level protection against a variant of the virus known as 'Novarg' or 'MyDoom.' The new variant, called 'Novarg.B' or 'MyDoom.B,' propagates via mass e-mail and also through a worm component that leverages the back doors installed by the virus' predecessor, MyDoom.A.

In its mass-mailing capacity, MyDoom.B arrives as an e-mail attachment, either as a Windows executable file with an .exe, .scr, .bat, .pif, or .cmd extension or as a zip file (.zip) containing the malicious executable. When the executable is launched, the virus harvests e-mail addresses from the victim's file system and sends a copy of itself to each address. MyDoom.B also contains an auto-propagating worm component that allows the virus to spread itself to systems that have already been infected with MyDoom.A. In this capacity, MyDoom.B scans random network blocks for systems listening on port 3127/tcp, and compromises new victims by exploiting the back door left by previous MyDoom.A infections.

All of the virus' propagation mechanisms will be disabled on March 1, 2004, but before that time MyDoom.B-infected hosts are programmed to launch denial of service attacks against www.sco.com and www.microsoft.com.