Re: WORM_MIMAIL.A Anyone have any info on what this does yet?
To: "Alex 'CAVE' Cernat" <email@example.com> Date: Mon, 04 Aug 2003 13:49:31 -0400
On Mon, 04 Aug 2003 18:57:06 +0300, "Alex 'CAVE' Cernat" <firstname.lastname@example.org> said:
> but if the virus connects directly to the 'backup' smtp server, then,
> lamerish, the virus programmer probably believed that bigger value
> associated with mx meens 'prefered server', which is the exactly
> opposite as the rfc or any documentation available :-)
Getting a comparison backward is a time-honored tradition in worm programs,
dating all the way back to the 1988 Morris worm (which had a < instead of a >
in a check for whether it should attack a given host - as a result, 5/6 of the
time it would pound the target rather than 1/6 of the time. This resulted in a
meltdown rather than a long-running stealthy worm).
- application/pgp-signature attachment: stored