[Snort-sigs] Mydoom.M signatures

Hugo van der Kooij hvdkooij at ...481...
Wed Jul 28 14:06:58 EDT 2004

On Wed, 28 Jul 2004, Roach4 wrote:

> Anyone is up with a signature for this new mydoom that seems to hit hard?
> More info can be found at
> http://securityresponse.symantec.com/avcenter/venc/data/w32.mydoom.m@...1512...

What do you call "hitting hard"? There was a burst on monday but it
withered out within a day to the usual background clutter.

See also: http://hvdkooij.xs4all.nl/cgi-bin/mailgraph.cgi for some
graphics to see the rise of rejects because I block a sender IP of any
infected message if it is not a bounce message.

At present I see more Swen.A like messages just trying to get through to
unknown users according to my sendmail logs.


 All email sent to me is bound to the rules described on my homepage.
    hvdkooij at ...481...		http://hvdkooij.xs4all.nl/
	    Don't meddle in the affairs of sysadmins,
	    for they are subtle and quick to anger.

More information about the Snort-sigs mailing list