[Snort-sigs] Mydoom.M signatures

Hugo van der Kooij hvdkooij at ...481...
Wed Jul 28 14:06:58 EDT 2004


On Wed, 28 Jul 2004, Roach4 wrote:

> Anyone is up with a signature for this new mydoom that seems to hit hard?
> More info can be found at
> http://securityresponse.symantec.com/avcenter/venc/data/w32.mydoom.m@...1512...

What do you call "hitting hard"? There was a burst on monday but it
withered out within a day to the usual background clutter.

See also: http://hvdkooij.xs4all.nl/cgi-bin/mailgraph.cgi for some
graphics to see the rise of rejects because I block a sender IP of any
infected message if it is not a bounce message.

At present I see more Swen.A like messages just trying to get through to
unknown users according to my sendmail logs.

Hugo.

-- 
 All email sent to me is bound to the rules described on my homepage.
    hvdkooij at ...481...		http://hvdkooij.xs4all.nl/
	    Don't meddle in the affairs of sysadmins,
	    for they are subtle and quick to anger.




More information about the Snort-sigs mailing list