[Full-Disclosure] Tracking a virus by logging infected machines
Richard M. Smith
rms at computerbytesman.com
Tue Sep 2 00:38:32 BST 2003
>>> Is there any way to determine who the winner is?
Not that I want to encourage virus writing, but I think it would be very
helpful to gather infection statistics if a virus were to keep a log of
the IP addresses of all the machines it infected. The log could be
appended to the end of the executable file of the virus. Each copy of a
worm or virus would contain a record of one branch of the tree of
To make a log easy to locate and extract, the log can start with an
easily identified string such as "VIRUS INFECTION LOG\n". IP addresses
should be recorded in ASCII with a \n between each IP address.
Full-Disclosure is hosted and sponsored by Secunia.