[33589] in bugtraq
Re: Why are postmasters distributing the MyDoom virus?
daemon@ATHENA.MIT.EDU (David F. Skoll)
Tue Feb 10 18:28:01 2004
Date: Tue, 10 Feb 2004 13:29:51 -0500 (EST)
From: "David F. Skoll" <dfs@roaringpenguin.com>
To: "Richard M. Smith" <rms@computerbytesman.com>
Cc: "BUGTRAQ@SECURITYFOCUS. COM" <BUGTRAQ@securityfocus.com>
In-Reply-To: <E1ApXw0-0003Lb-00@smtp03.mrf.mail.rcn.net>
Message-ID: <Pine.LNX.4.58.0402101308100.4320@shishi.roaringpenguin.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
On Sat, 7 Feb 2004, Richard M. Smith wrote:
> I was looking over the MyDoom email messages that I received today and found
> about 15 copies of the worm which came from postmasters in bounce messages.
> Some postmasters, when sending out a bounce message, include the original
> email message as an attachment. If a bounce message is for a
> MyDoom-infected message, the bounce message will sometimes include an intact
> copy of the MyDoom executable which can be run by mistake with a few mouse
> clicks.
This is sometimes unavoidable. A lot of MyDoom's go to nonexistent
recipients, and when they are failed with a 5xx failure code, the sending
relay (quite reasonably) includes the original message in the bounce.
Regards,
David.
