2004 · Security

Mydoom: the fastest-spreading email worm of its time

Last reviewed 16 October 2026

In January 2004 Mydoom spread by fake bounced-email messages, opened a backdoor on infected PCs, and used them to attack SCO’s website.

What happened

Mydoom, also called Novarg, was first seen on 26 January 2004. Within a day it had overtaken earlier worms such as Sobig.F to become the fastest-spreading email worm yet recorded. Security companies estimated that at its peak it accounted for a large share of all email on the internet; published estimates ranged from around one message in twelve to a quarter of all traffic.

How it spread

Mydoom arrived as an email that looked like a technical error. Subject lines such as “Mail Delivery System” or “Test” and messages saying the original email could not be shown were chosen to make people open the attachment to see what had gone wrong. The attachment was a Windows program, sometimes inside a ZIP file.

Once run, the worm harvested email addresses from files on the computer and sent itself to them, using its own mail engine and forging the sender. It also copied itself into the shared folder of the Kazaa file-sharing program under tempting file names.

The backdoor and the attack on SCO

Mydoom opened a backdoor on infected computers, listening on a TCP port in the 3127 to 3198 range, so that they could be controlled remotely. The original version was also programmed to launch a distributed denial-of-service attack on the website of the SCO Group from 1 February 2004 and to stop spreading on 12 February.

SCO was then suing IBM and others over claims that Linux contained its code, which made it unpopular with many in the open-source world. That led to speculation about the author’s motives, though there was no evidence connecting the worm to the Linux community. SCO’s site was knocked offline and the company moved it to a new address. A variant, Mydoom.B, targeted Microsoft’s website and blocked access to antivirus sites.

SCO and Microsoft each offered a reward of $250,000 for information leading to the author’s arrest. The author was never identified. The worm’s code contained the text “andy; I’m just doing my job, nothing personal, sorry”.

Why it is still mentioned

Mydoom marked a shift from worms written for notoriety to worms that built networks of controllable machines. Its backdoor was later used by other malware, and code based on it turned up again in denial-of-service attacks on South Korean and US websites in July 2009.

It is regularly listed among the most costly malware outbreaks, with damage estimates in the tens of billions of dollars, although such figures are rough by nature.