RE: Worm.SCO.A

["Jones, Steve" <sjones () LMIT com>]

I found a good analysis of the code off of another mailing list - the link
is posted below.  Worth checking out if you're curious.

How do you think Trend feels now that everyone knows it's not a MiMail
variant?

http://www.math.org.il/newworm-digest1.txt

god bless the .gov exception :)

-Steve

-----Original Message-----
From: Michael Bellears [mailto:MBellears () staff datafx com au] 
Sent: Tuesday, January 27, 2004 6:02 PM
To: Shawn Jackson; security-basics () securityfocus com
Subject: RE: Worm.SCO.A

>       Anyone else encountering this? I've just got hammered 
> with a few hundred of these in the last hour and a half and I 
> can't quite discern what exactly the virii is. There doesn't 
> seam to be a map from ClamAV virus naming format to any 
> other. Anyone have a clue of what this virus is?

Mydoom.A (Aliases - Mimail.R, Novarg.A, Shimg, W32.Novarg.A@mm,
W32/Mydoom@MM)

I've seen approx. 6000 in the last 24 hours.

Regards,
MB

---------------------------------------------------------------------------
Ethical Hacking at InfoSec Institute. Mention this ad and get $720 off any 
course! All of our class sizes are guaranteed to be 10 students or less. 
We provide Ethical Hacking, Advanced Ethical Hacking, Intrusion Prevention, 
and many other technical hands on courses. 
Visit us at http://www.infosecinstitute.com/securityfocus to get $720 off 
any course!  
----------------------------------------------------------------------------

---------------------------------------------------------------------------
Ethical Hacking at InfoSec Institute. Mention this ad and get $720 off any 
course! All of our class sizes are guaranteed to be 10 students or less. 
We provide Ethical Hacking, Advanced Ethical Hacking, Intrusion Prevention, 
and many other technical hands on courses. 
Visit us at http://www.infosecinstitute.com/securityfocus to get $720 off 
any course!  
----------------------------------------------------------------------------