Re: other virus damages/costs...

[Gregory Hicks <ghicks () cadence com>]

Here is another 'take' on the same subject as forwarded by Barney
Wolff...  Based on analysis of several hundred samples, what Todd says
seems to be true...  (I also have to admit that the analysis is not
'complete' since I based MY analysis on only several hundred messages,
but so far, it seems to be holding true.)

I wonder how long this will be true?  Missing the headers, I mean?

Regards,
Gregory Hicks

------------- Begin Forwarded Message -------------

Date: Mon, 2 Feb 2004 13:40:28 -0500 (EST)
From: Todd Vierling <tv () duh org>

On Mon, 2 Feb 2004, Randy Bush wrote:

: # MyDoom craziness
: :
: * ^Subject:.*(\

Actually, Mydoom has a very detectable signature.  It has both
X-Priority and X-MSMail-Priority headers, but *neither* a X-Mailer nor
X-MimeOLE header.

These conditions make, for instance, SpamAssassin catch the worm
easily.  Based on all the available mailboxes I can scan from here,
such a check should kill only Mydoom [and some spam].

Rolled that into a milter, and poof!

-- 
-- Todd Vierling <tv () duh org> <tv () pobox com>

------------- End Forwarded Message -------------


-------------------------------------------------------------------
Gregory Hicks                        | Principal Systems Engineer
Cadence Design Systems               | Direct:   408.576.3609
555 River Oaks Pkwy M/S 6B1          | Fax:      408.894.3400
San Jose, CA 95134                   | Internet: ghicks () cadence com

"The trouble with doing anything right the first time is that nobody
appreciates how difficult it was."

When a team of dedicated individuals makes a commitment to act as
one...  the sky's the limit.

Just because "We've always done it that way" is not necessarily a good
reason to continue to do so...  Grace Hopper, Rear Admiral, United
States Navy

_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards