Re: WORM_MIMAIL.A Anyone have any info on what this does yet?

[[EMAIL PROTECTED]]

On Mon, 04 Aug 2003 18:57:06 +0300, "Alex 'CAVE' Cernat" <[EMAIL PROTECTED]>  said:

> but if the virus connects directly to the 'backup' smtp server, then,
> lamerish, the virus programmer probably believed that bigger value
> associated with mx meens 'prefered server', which is the exactly
> opposite as the rfc or any documentation available :-)

Getting a comparison backward is a time-honored tradition in worm programs,
dating all the way back to the 1988 Morris worm (which had a < instead of a >
in a check for whether it should attack a given host - as a result, 5/6 of the
time it would pound the target rather than 1/6 of the time.  This resulted in a
meltdown rather than a long-running stealthy worm).

Attachment: pgpJmuzjLDT6z.pgp
Description: PGP signature