At 4 am Sunday morning New York time a besieged SCO sent out a message saying that a large-scale Denial of Service attack had overwhelmed its site. Independent experts such as UK-based mi2g confirmed that SCO was paralyzed.

According to mi2g,"All legitimate requests to download pages from several cities across the globe were completely timing out as of 20:00 hours GMT" Saturday and "since then there has been no sign of capability to serve web pages or entertain http requests by www.sco.com including all of Sunday."

Based on what is known about the virus, SCO said it expected the attacks to continue through February 12. A separate, ostensibly smaller MyDoom.b wave is expected to hit SCO on Tuesday when the virus is also supposed to launch an attack against Microsoft.

Jeff Carlon, SCO's unenviable worldwide director of IT infrastructure, promised "a series of contingency plans" that will undoubtedly involve moving the site around to other URLs.

In a prepared statement, Carlon said to stand by for SCO to take action on Monday. On Sunday, mi2g was wondering why SCO's senior management had yet to take www.sco.com out of the Domain name server (DNS) system or redirect the http requests elsewhere.

Virus experts at the Kaspersky Laboratory in Moscow say the virus started in Russia, according to the Itar-Tass news service. Western experts seem to agree.

At a news conference on Friday, Kaspersky said MyDoom's perpetrator or perpetrators appear to retrieve secret information from infected computers that they can sell, Tass said. They can also profit from circulating spam using the address books culled from the infected computers.

Mi2g figures MyDoom is now the most destructive virus ever, beating the record set by SoBig. The British virus watcher calculates that MyDoom has done $38.5 billion worth of damage so far in terms of overtime payments, contingency outsourcing, loss of business, bandwidth clogging, productivity erosion, management time reallocation, cost of recovery and software upgrades

The only good news mi2g has to report is that the number of new MyDoom infections worldwide had slowed down somewhat on Sunday. It said, "Only about 10 of the top 50 web hosts and ISPs in the world are showing any signs of abnormal delay on their networks or periodic failed requests made to their web site at this stage.

More alarming, however, is mi2g's conclusion that the perpetrator of MyDoom is a "clever strategist combined with being a sophisticated programmer."

• "If ISPs Are Blocking Sco.com Today, What Happened Jan 28/29?"
• SCO Takes www.sco.com Out of the DNS
• MyDoom - SCO/Microsoft Update
• Mail Bag: Inflatable Dolls Called Mommy
• Is Your TCP Port 3127 Open? Then Watch Out for "MyDoom.C"