On Sat, 7 Feb 2004, Richard M. Smith wrote: > I was looking over the MyDoom email messages that I received today and found > about 15 copies of the worm which came from postmasters in bounce messages. > Some postmasters, when sending out a bounce message, include the original > email message as an attachment. If a bounce message is for a > MyDoom-infected message, the bounce message will sometimes include an intact > copy of the MyDoom executable which can be run by mistake with a few mouse > clicks. This is sometimes unavoidable. A lot of MyDoom's go to nonexistent recipients, and when they are failed with a 5xx failure code, the sending relay (quite reasonably) includes the original message in the bounce. Regards, David.
