RE: Mydoom

[Nick FitzGerald <nick () virus-l demon co uk>]

<jsklein () mindspring com> wrote:

> 22,528 bytes

No -- as I explained in my reply, and others have posted empirical data 
backing up the claim, the size of the zip attachment form varies 
depending on the length of the filename within the archive.

> More details at: 
> http://securityresponse.symantec.com/avcenter/venc/data/w32.novarg.a@mm.
> html

Could I suggest that you use a more reliable or more detailed source of 
your information?

That page does not specifically address the "zip attachment" form at 
all, and to the extent that it does mention .ZIP extensions it (_quite_ 
incorrectly) implies that the virus' executable is simply packaged with 
such an extension.  In fact, if it sends itself with a .ZIP extension, 
Mydoom sends itself as a proper zip archive that contains a "stored" 
(i.e. not compressed) copy of its executable.


-- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html