full-disclosure - Does anyone have MyDoom.B?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <4300CB80-5297-11D8-AF1F-000393D1722A@nonmundane.org>
From: dspisak at nonmundane.org (Daniel Spisak)
Subject: Does anyone have MyDoom.B?

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I'm looking for a copy of MyDoom.B to analyze. It seems as if the only  
people/places that have seen this are the large A/V people.

Trend Micro seems to think only one system (at the time I write this)  
has been infected (as they track it at least which isn't very  
accurate). Source:  
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp? 
VName=WORM_MYDOOM.B&VSect=S

MessageLabs doesn't even list MyDoom.B on their list of active viruses  
they've seen in the wild. Source:  
http://www.messagelabs.com/viruseye/threats/list/default.asp

I've seen some news reports that would seem to indicate that MyDoom.B  
might not be propagating as fast as MyDoom.A has been and in fact might  
be potentially flawed in how it spreads itself? Source:  
http://www.theaustralian.news.com.au/common/story_page/ 
0,5744,8533540%255E1702,00.html

I've gotten plenty of copies of MyDoom.A into my various inboxes but  
have yet to see a single instance of MyDoom.B and from talking to a few  
here and on other lists this seems to be the common case. No one I've  
talked to has this new variant. If anyone has a copy of MyDoom.B or  
gets a copy I would really appreciate it if anyone could email it to  
me, thanks!

Daniel E. Spisak
Security Engineer
OnlineSecurity
www.onlinesecurity.com
dan@...inesecurity.com
Cell: 562.331.1603

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.3

iQA/AwUBQBlo4RUn/Hz8mr7jEQL5PgCfTyOyJf8Z4YpN6J/gYZH7k5KB7SgAnA8c
45dTpRdDKwEETU83llXMiIJr
=f3Cn
-----END PGP SIGNATURE-----