At 10:04 AM 7/20/2001, you wrote:
> I tried that command line and it came back zero. > Is this worm looking for US based servers by IP address or is it a world > wide phenomenon? > > Phil > It's supposed to be quasi-random in that all machines infected will generate the same set of random addresses (bad seed choice). I don't know whether it then filtered to ensure only US ips got hit (Why would they? In their minds the more machines they control the better)
One thought here by the people who found it is that one of the first addresses is the originator so they can track the infected machines. It is suppose to become random, it just starts with the same machines.