Stories
Slash Boxes
Comments
NOTE: use Perl; is on undef hiatus. You can read content, but you can't post it. More info will be forthcoming forthcomingly.

All the Perl that's Practical to Extract and Report

use Perl Log In

Log In

[ Create a new account ]

Matts (1087)

Matts
  (email not shown publicly)

I work for MessageLabs [messagelabs.com] in Toronto, ON, Canada. I write spam filters, MTA software, high performance network software, string matching algorithms, and other cool stuff mostly in Perl and C.

Journal of Matts (1087)

Tuesday January 27, 2004
03:12 AM

Virus: MyDoom

[ #17030 ]

This new big one is called "MyDoom". I've had over 2000 copies so far (though a lot appear to be corrupt). I think this might be a new record setter.

The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
 Full
 Abbreviated
 Hidden
More | Login | Reply
Loading... please wait.
  • After 8 hours, I'm getting back to about half the rate I got during the initial deployment, meaning about 500 virus attacks an hour.

    But the biggest problem is not that. It's the stupid antivirus email to tell me that I am infected! I am not! This was a joe-job.

    And the worst part is that I can develop a procmailrc filter for the virus mail, but not for the antivirus email.

    If you are reading this and work for a company like Norton or Symantec, please tell someone how bad this is for all of us.

    --
    • Randal L. Schwartz
    • Stonehenge
    • > And the worst part is that I can develop a procmailrc filter for the virus mail, but not for the antivirus email.

      I grew desperate during the last outbreak... the below worked pretty well. Remove spurious linebreaks as necessary. This was of course last year, when I still cared about having messages falsely flagged as crap-- now I would store them all safely into /dev/null.

      :0
      * ^Subject: .*(automated response|(failure|mail) (delivery|noti|system)|delivery (fail|noti|problem|report|stat|unsucc|war