<[EMAIL PROTECTED]> wrote: > 22,528 bytes
No -- as I explained in my reply, and others have posted empirical data backing up the claim, the size of the zip attachment form varies depending on the length of the filename within the archive. > More details at: > http://securityresponse.symantec.com/avcenter/venc/data/[EMAIL PROTECTED] > html Could I suggest that you use a more reliable or more detailed source of your information? That page does not specifically address the "zip attachment" form at all, and to the extent that it does mention .ZIP extensions it (_quite_ incorrectly) implies that the virus' executable is simply packaged with such an extension. In fact, if it sends itself with a .ZIP extension, Mydoom sends itself as a proper zip archive that contains a "stored" (i.e. not compressed) copy of its executable. -- Nick FitzGerald Computer Virus Consulting Ltd. Ph/FAX: +64 3 3529854 _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
