MyDoom downs SCO site

SCO confirmed that the site had been deluged with data hours earlier than the official start of the attack. "Internet traffic began building momentum on Saturday evening and by midnight eastern time the SCO Web site was flooded with requests beyond its capacity," the company said in its statement.

The speed and severity of the attack surprised security officials. "This is the biggest single (denial of service) attack ever," Mikko Hypponen, director of antivirus research at F-Secure, wrote in an update on the security company's Web site. "We estimate the total amount of infected computers to be over one million. Of those, only the computers that have been rebooted (or infected) today are actually attacking."

SCO had been targeted for the denial-of-service attack last week. At the time, SCO had said it hoped to keep its Web site running and had contingency plans in place. In its statement Sunday, the company said it would wait until early Monday to communicate them.

"We didn't expect a lot of business on Super Bowl Sunday," Stowell said, explaining the reason to hold off on the contingency plans. The site attracts an estimated hundreds of thousands of users each week, he said. The site is used to communicate information about SCO as well as provide software updates and patches.

SCO has incurred the wrath of the Linux community for its claims that important pieces of the open-source OS are covered by SCO's Unix copyrights. IBM, Novell and other Linux backers strongly dispute the claims.

SCO has offered a $250,000 bounty for information leading to the arrest and conviction those who are responsible for the virus.

MyDoom is one of the fastest-growing worms ever. The bug raced onto the Internet on Monday, quickly clogging e-mail servers. Some analysts speculate the worm is of Russian origin.

A variant of MyDoom is expected to attack Microsoft's main Web site on Tuesday. Microsoft also has offered a $250,000 bounty to catch the worm's perpetrator.

The attack aimed at Microsoft by computers infected with the B variant of MyDoom is not expected to have as much effect because that version hasn't spread as widely, said Vincent Weafer, a senior director at computer-security company Symantec.

"Really, we are seeing very little of the B variant," he said.

The original virus, which only attacks the SCO site, is continuing its attempts at spreading, he added. During the height of the epidemic, the company received about 150 submissions of the virus every hour from companies and home users. Now, Symantec is seeing about half that rate of submissions, mainly from home users.

"The virus is not dropping off as fast as we had expected," he said.

CNET News.com's Robert Lemos and Jon Skillings contributed to this report.