Why does the MyDoom worm avoid some sites??? Any thoughts on this??

[rutchtkim]

So the MyDoom worm avoids some areas such as Rutgers University. What do you guys think about this? Perhaps the coders originated from these places?

"Mydoom avoids targeting e-mail addresses at certain universities, such as Rutgers, MIT, Stanford and UC Berkeley, as well as certain companies such as Microsoft and Symantec. Some early reports claimed the worm avoids all .edu addresses, but this is not the case. "

http://en.wikipedia.org/wiki/Mydoom

 

[Tom]

because the coder is an idiot.

 

[Jzero]

I think the coder is a Rutgers student and made this post to throw the authorities off

 

[emmpee]

Originally posted by: rutchtkim
So the MyDoom worm avoids some areas such as Rutgers University. What do you guys think about this? Perhaps the coders originated from these places? "Mydoom avoids targeting e-mail addresses at certain universities, such as Rutgers, MIT, Stanford and UC Berkeley, as well as certain companies such as Microsoft and Symantec. Some early reports claimed the worm avoids all .edu addresses, but this is not the case. " http://en.wikipedia.org/wiki/Mydoom

it actually has a list of 40 or so email strings that it avoids, there's way too many for the coders to have "originated from" all of these places.

 

[FoBoT]

that is the virus authors white list

 

[SunnyD]

Potential forensic sites that would be able to track down the author with relative ease?