Bugtraq mailing list archives
Re: Why are postmasters distributing the MyDoom virus?
From: "David F. Skoll" <dfs () roaringpenguin com>
Date: Tue, 10 Feb 2004 13:29:51 -0500 (EST)
On Sat, 7 Feb 2004, Richard M. Smith wrote:
I was looking over the MyDoom email messages that I received today and found about 15 copies of the worm which came from postmasters in bounce messages. Some postmasters, when sending out a bounce message, include the original email message as an attachment. If a bounce message is for a MyDoom-infected message, the bounce message will sometimes include an intact copy of the MyDoom executable which can be run by mistake with a few mouse clicks.
This is sometimes unavoidable. A lot of MyDoom's go to nonexistent recipients, and when they are failed with a 5xx failure code, the sending relay (quite reasonably) includes the original message in the bounce. Regards, David.
Current thread:
- Why are postmasters distributing the MyDoom virus? Richard M. Smith (Feb 10)
- Re: Why are postmasters distributing the MyDoom virus? David F. Skoll (Feb 10)
- Re: Why are postmasters distributing the MyDoom virus? mgotts (Feb 11)
- Re: Why are postmasters distributing the MyDoom virus? Georg Schwarz (Feb 12)
- <Possible follow-ups>
- RE: Why are postmasters distributing the MyDoom virus? Harley David (Feb 10)
- Re: Why are postmasters distributing the MyDoom virus? David F. Skoll (Feb 10)