Re: WORM_MIMAIL.A Anyone have any info on what this does yet?

Valdis.Kletnieks_at_vt.edu
Date: 08/04/03

  • Next message: Jason Alexander: "Re: Pdmin / Trojaned csrss.exe"
    To: "Alex 'CAVE' Cernat" <cave@cernat.ro>
    Date: Mon, 04 Aug 2003 13:49:31 -0400
    
    
    

    On Mon, 04 Aug 2003 18:57:06 +0300, "Alex 'CAVE' Cernat" <cave@cernat.ro> said:

    > but if the virus connects directly to the 'backup' smtp server, then,
    > lamerish, the virus programmer probably believed that bigger value
    > associated with mx meens 'prefered server', which is the exactly
    > opposite as the rfc or any documentation available :-)

    Getting a comparison backward is a time-honored tradition in worm programs,
    dating all the way back to the 1988 Morris worm (which had a < instead of a >
    in a check for whether it should attack a given host - as a result, 5/6 of the
    time it would pound the target rather than 1/6 of the time. This resulted in a
    meltdown rather than a long-running stealthy worm).

    
    



  • Next message: Jason Alexander: "Re: Pdmin / Trojaned csrss.exe"