Full Disclosure mailing list archives
Re: MyDoom download info
From: Paul Schmehl <pauls () utdallas edu>
Date: Sat, 31 Jan 2004 14:20:28 -0600
--On Saturday, January 31, 2004 12:25 PM -0500 Valdis.Kletnieks () vt edu wrote:
On Sat, 31 Jan 2004 12:03:37 +1300, Steve Wray <steve.wray () paradise net nz> said: What worries me is we haven't seen *either* an actual damaging virus (imagine if the last 2 lines of Mydoom were "sleep(4hours); exec("format c:);") or a "sleeper" virus.
This doesn't worry me much at all. Since virus writing has been taken over by the scammers, spammers, criminals and thieves, the last thing they want to do is destroy their bots. Their purpose isn't to infect and harm, it's to infect and use for their nefarious purposes - like the recent extortion attempts on online gambling sites (threatening to shut them down through DDoS during the Super Bowl thereby depriving them of large amounts of revenue.)
The irony is the vxers got replaced by the professional criminals. Now the concern is not getting infected, it's making sure the computer is really and truly clean. It would be nice if the malware *did* use exec(format C:). It would save networks a lot of time cleaning up and identify the infected machines quickly. :-)
Paul Schmehl (pauls () utdallas edu) Adjunct Information Security Officer The University of Texas at Dallas AVIEN Founding Member http://www.utdallas.edu _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: MyDoom download info, (continued)
- Re: MyDoom download info Daniel Spisak (Jan 30)
- Re: MyDoom download info Scott Taylor (Jan 30)
- Re: MyDoom download info Valdis . Kletnieks (Jan 31)
- Re: MyDoom download info Oliver Schneider (Jan 31)
- Re: MyDoom download info Daniel Spisak (Jan 30)
- Re: MyDoom download info Roland Dobbins (Jan 31)
- mydoom.exe decyphering? Danny (Jan 31)
- Re: [Full-Disc]: mydoom.exe decyphering? Anders (Jan 31)
- RE: MyDoom download info first last (Jan 30)
- RE: MyDoom download info Steve Wray (Jan 30)
- Re: MyDoom download info Valdis . Kletnieks (Jan 31)
- Re: MyDoom download info Paul Schmehl (Jan 31)
- RE: MyDoom download info Steve Wray (Jan 31)
- RE: MyDoom download info Bojan Zdrnja (Jan 31)
- RE: MyDoom download info Steve Wray (Jan 30)
- Re: MyDoom download info Puneet Arora (Jan 31)
- RE: MyDoom download info Steve Wray (Jan 30)