Full Disclosure mailing list archives
Tracking a virus by logging infected machines
From: "Richard M. Smith" <rms () computerbytesman com>
Date: Mon, 1 Sep 2003 19:38:32 -0400
Hi Jason, >>> Is there any way to determine who the winner is? Not that I want to encourage virus writing, but I think it would be very helpful to gather infection statistics if a virus were to keep a log of the IP addresses of all the machines it infected. The log could be appended to the end of the executable file of the virus. Each copy of a worm or virus would contain a record of one branch of the tree of infected machines. To make a log easy to locate and extract, the log can start with an easily identified string such as "VIRUS INFECTION LOG\n". IP addresses should be recorded in ASCII with a \n between each IP address. Richard _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Virus, whether the scanners say so or not? Scott Phelps / Dreamwright Studios (Sep 01)
- Re: Virus, whether the scanners say so or not? Bennett Todd (Sep 01)
- Re: Virus, whether the scanners say so or not? Paul Schmehl (Sep 01)
- Re: Virus, whether the scanners say so or not? misiu_ (Sep 01)
- Re: Virus, whether the scanners say so or not? gregh (Sep 01)
- Random SoBig.F Thoughts Jason Coombs (Sep 01)
- Tracking a virus by logging infected machines Richard M. Smith (Sep 01)
- Re: Tracking a virus by logging infected machines Ralf (Sep 01)
- Re: Tracking a virus by logging infected machines Marcus Graf (Sep 02)
- Re: Tracking a virus by logging infected machines morning_wood (Sep 02)
- Re: Tracking a virus by logging infected machines Joel R. Helgeson (Sep 02)
- RE: Tracking a virus by logging infected machines Richard M. Smith (Sep 02)
- Tracking a virus by logging infected machines Richard M. Smith (Sep 01)
- <Possible follow-ups>
- Re: Virus, whether the scanners say so or not? roman . kunz (Sep 01)
- Fw: Virus, whether the scanners say so or not? morning_wood (Sep 01)