Re: Why are postmasters distributing the MyDoom virus?

[David F. Skoll]

On Sat, 7 Feb 2004, Richard M. Smith wrote:

> I was looking over the MyDoom email messages that I received today and found
> about 15 copies of the worm which came from postmasters in bounce messages.
> Some postmasters, when sending out a bounce message, include the original
> email message as an attachment. If a bounce message is for a
> MyDoom-infected message, the bounce message will sometimes include an intact
> copy of the MyDoom executable which can be run by mistake with a few mouse
> clicks.

This is sometimes unavoidable. A lot of MyDoom's go to nonexistent
recipients, and when they are failed with a 5xx failure code, the sending
relay (quite reasonably) includes the original message in the bounce.

Regards,

David.

[Harley David]

And just to make things a little more interesting, informal
testing suggests that at least two AV products have trouble
recognising and scanning bounced viral attachments. MIME
boundary issues, perhaps.

--=20
David Harley
Threat Assessment Centre Manager
Anti-Virus/Email Abuse Specialist
NHS Information Authority


This e-mail is confidential and privileged. If you are not the intended =
recipient please accept our apologies; please do not disclose, copy or =
distribute information in this e-mail or take any action in reliance on =
its contents: to do so is strictly prohibited and may be unlawful. =
Please inform us that this message has gone astray before deleting it. =
Thank you for your co-operation.