'Mydoom' virus still attacking SCO site

The "Mydoom" computer worm remains in attack mode at Lindon-based SCO Group Inc.

The worm was designed to flood SCO's Web site with so much e-mail inquiry traffic that it would lock up the site from Feb. 1 through Thursday. But Friday, a day after the scheduled conclusion, the traffic was still coming.

The company, armed with a few days to prepare for the worm, had shut down its usual Web site, www.sco.com, on Feb. 1 and provided an alternative site, www.thescogroup.com.

"We expect the attack will continue but trail off this weekend," company spokesman Blake Stowell said Friday. "My guess is that we will probably be able to use our usual Web site starting early next week, Monday or Tuesday. But right now, from what we can tell, the attack is still taking place."

Some of the attack-related e-mails hit prior to Feb. 1, and the cause of those probably is also resulting in the lingering effects seen Friday, he said: computers with internal calendars set to incorrect dates, with some thinking Feb. 12 has yet to be reached.

"And when you consider this has affected anywhere from hundreds of thousands to millions of computers around the world, there may still be a lot of people who don't know their computer has a virus on it, and that's problematic for us," Stowell said.

SCO technicians' tests during the first 12 days of February indicated the attack, known as a "distributed denial-of-service" attack, flooded SCO's Internet service provider with more traffic than it could handle, given the amount of available bandwidth, he said.

The company has yet to gauge the costs associated with the attack, but mostly it appears to be from employees needing to let stakeholders know about the alternative Web site. "It's been more of a time investment than a money investment," he said.

SCO is offering a $250,000 reward for the arrest and conviction of whoever created the worm. Some people unable to reach the FBI have called Stowell. "If that is any indication, there are lots of leads probably coming in. How significant those leads are, only the FBI could really answer that."

SCO has been hit with at least three other service-denial attacks on its Web site during the past 10 months. While each was different, they also provided the company with a chance to deal with attack hassles and prepare better to handle ones in the future.