[Dshield] Time limits on virii

Brad Biggers dshield-list at izallgood.net
Sun Feb 29 00:58:15 GMT 2004


The one thing that i have noticed about recent virii activity, is that
they all use lots of bandwidth in the process of sending out  email or
scanning networks. Also most virii have a secondary payload is a trojan. 

the first part of the attack is to get the trjan installed on as many
computers as possible.

the second is to use the compermised system to launch attacks on other
systems, ie the recent attacks on microsoft, and  sco. or to relay spam. 
if the virii was still active it would be easyer to detect. msblaster and
mydoom can easly cause a 56k dialup connection to be unusable. they can
even cause problems on highspeed connectins depending on the applications
being ran across it.


just my 2c worth.


Brad


~~~~~~~~~~~~~~~~~~~~~~~~~~

But those who wait on the LORD will find new strength. They will fly high
on wings like eagles. They will run and not grow weary. They will walk and
not faint.  <Isaiah 40:31>

On Sat, 28 Feb 2004, Carboni, Chris wrote:

> Date: Sat, 28 Feb 2004 17:35:49 -0600
> From: "Carboni, Chris" <ccarboni at azerty.com>
> Reply-To: General DShield Discussion List <list at dshield.org>
> To: General DShield Discussion List <list at dshield.org>
> Subject: [Dshield] Time limits on virii
> 
> Ok, so I'm sitting here reading about Bagle.D and notice that this worm,
> like many others is set to deactivate after a certain date, March 14th, 2004
> in this case.
> 
> So let me ask this.  If I'm a virus writer, why would I want my bug to
> deactivate after a certain date?  What's the advantage to me?  What purpose
> does deactivating fulfill?
> 
> ~Chris
> 
> _______________________________________________
> list mailing list
> list at dshield.org
> To change your subscription options (or unsubscribe), see: http://www.dshield.org/mailman/listinfo/list
> 




More information about the list mailing list