--BOKacYhQ+x31HxR3
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Mm... Good points. I hadn't thought about it with regards to bandwidth
issues, etc. Perhaps then just a simple script running on a webserver that
sends an e-mail to postmaster@infected.ip.that.hit? Or would that be
considered unsolicited e-mail/SPAM?

-- Mondoshawan

On Mon, Aug 06, 2001 at 10:57:22AM -0700, Kurt Granroth wrote:
> On Monday 06 August 2001 07:07 am, Thomas Mondoshawan Tate wrote:
> > Just had a crazy thought about all this RC mess. How about writing an
> > anti-worm-worm (or vaccine) that uses the same infection method, but
> > removes all copies of the RC and RCII worm from the system, notifies the
> > system admin of each box it's run on and then kills itself after a
> > specified date? You could then write a script on your apache system that
> > logs the IP of the infected host, and then schedules an
> > anti-infection-infection to be run later. Whaddya think? Good, bad, ugl=
y?
>=20
> Tempting, but ethically ambiguous and definitely illegal.  This isn't=20
> theoretical, btw, there is a "worm" for Linux that does something very=20
> similar.  It was/is called the "cheese worm" and it supposed tries to rid=
=20
> "infected" Linux systems of known worms and backdoors.  Check out this li=
nk:
> http://slashdot.org/articles/01/05/17/0038205.shtml
>=20
> If you read the feedback (mod +5 works well), you'll see the prevailing v=
iew=20
> of this.  It may *seem* like a good idea, but in the end it's still just =
an=20
> uncontrolled program breaking into another computer.
> --=20
> Kurt Granroth            | http://www.granroth.org
> KDE Developer/Evangelist | SuSE Labs Open Source Developer
> granroth@kde.org         | granroth@suse.com
>             KDE -- Conquer Your Desktop
> ________________________________________________
> See http://PLUG.phoenix.az.us/navigator-mail.shtml if your mail doesn't p=
ost to the list quickly and you use Netscape to write mail.
>=20
> PLUG-discuss mailing list  -  PLUG-discuss@lists.PLUG.phoenix.az.us
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

--BOKacYhQ+x31HxR3
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE7buRzYp5mUsPGjjwRAqPdAKCJNQC0Q4xwHUBS1l1ar0W7uEuVzQCfacX3
0MxsTNnIkjiirVnATaOFCEU=
=Psiq
-----END PGP SIGNATURE-----

--BOKacYhQ+x31HxR3--