Updated virus alerts: MyDoom raised to high alert

The latest MyDoom worm, first spotted yesterday has been raised to a high alert warning by Computer Associates Virus Information Centre.

Several new worms were spotted in the wild yesterday including a variant of Sober, which has so far hit the radar screens of many major antivirus firms; a variant of Bropia; and the new MyDoom – taking the total number of variants of that worm beyond 50.

However, despite a flurry of activity two of the worms carry low-to-medium warnings, while the spread of the latest MyDoom has provided some cause for concern.

Simon Perry, senior VP security at CA, warned that the worm while familiar in many ways opens a backdoor vulnerability that is then "open to something much more sinister".

Perry said the threat of a "zombie or slave machine" being created by this backdoor vulnerability, in line with a number of other attacks in recent months which have enable denial of service attacks and the sending of spam, encouraged the company to raise its warning level on this latest worm to 'high'.

The latest MyDoom variant is being called .BA, also confusingly .AW, .AX, .AZ and even .BB and.BC as each new variant and subsequent signature is named alphabetically. (Read more about virus definitions and naming, here.)

The Sober.K worm is a mass-mailer and some versions intercepted by UK email security firm MessageLabs pose as a virus warning urging users to download a patch to protect them from the very worm they install by doing so.

The self-referential subject line of these emails reads: "Alert! New Sober worm". Other subject lines include references to illegal websites it claims the recipient has visited and also the notorious Paris Hilton sex video.

MessageLabs spotted the first version of Sober.K at 05:01 (GMT) in Germany. So far the company has blocked over 1,400 copies with subject lines and text in English and German.

Bropia.J (or Bropia.I) is also spreading in small numbers with the capability to spread via MSN Messenger, according to an alert on the Computer Associates Virus Information Centre.