A computer-virus reward announcement can describe a criminal investigation, while a bug bounty usually concerns an eligible vulnerability report. Before acting, identify what information is being requested, who receives it and which current terms apply.
A historical announcement establishes what was offered at that time. For any present-day claim of eligibility or payment, consult the sponsoring organization's current official information.
The January 2004 Mydoom.B reward
On January 29, 2004, Microsoft announced a US $250,000 reward for information resulting in the arrest and conviction of those responsible for releasing Mydoom.B. The announcement connected the offer with law-enforcement cooperation and the wider disruption caused by the worm.
The qualifying event was information contributing to a criminal case. Finding an infected computer, removing a file or reporting an ordinary software defect described different activities. This article records that historical offer; its continuing availability is not established here.
For the technical history, see Mydoom’s deceptive email and backdoor behavior. A reader responding to a current infection should use the response guide before pursuing the separate question of reporting.
Choose the route that matches the information
| What you have | Appropriate starting point | What to verify |
|---|---|---|
| Evidence about a suspected cybercrime | The relevant official law-enforcement reporting service | Jurisdiction, requested information and how originals should be retained. |
| An incident affecting your organization | Your designated responder and reporting process | Who coordinates evidence, notifications and operational recovery. |
| A vulnerability found through authorized research | The affected vendor’s security-reporting program | Scope, permitted testing, disclosure process and eligibility terms. |
| A claim that a reward is available | The named sponsor’s official announcement and current terms | Whether the offer is current and what conditions actually apply. |
One event may require more than one route, but the submissions serve different purposes. Agree on responsibilities within an organization so evidence and timelines stay consistent.
Read the actual bounty terms
Microsoft’s bounty guidelines distinguish eligible products, submission requirements, program rules and discretionary awards. Other programs define their own scope. Read the exact program's current terms before research or submission; a publicly reachable system is not permission to test it.
Check the product and version, permitted methods, reporting destination, disclosure requirements and any eligibility restrictions. A maximum award displayed in a program describes a possible award under its conditions, not a payment owed for every report. Keep a dated record of the terms relevant to your authorized work.
Keep the report factual and preserve originals
The U.S. Internet Crime Complaint Center FAQ explains its complaint process and evidence handling. It says to retain original supporting material securely; its complaint process does not accept attachments. The FAQ also explains that the volume of complaints prevents a response to every submission.
Record what happened, when it happened, the relevant accounts or systems and what you personally observed. Distinguish observations from conclusions supplied by someone else. For technical collection on a compromised machine, follow a qualified responder's instructions rather than improvising changes that could lose evidence.
Use reporting links found independently through official sources. Keep private material out of public posts and send it only through the appropriate channel. For locations outside the United States, check the relevant national or local reporting route and the scope of any international service you use.
Fictional example: an old reward link
A reader finds a twenty-year-old announcement and believes a recent malware alert qualifies for payment. They first identify the date, sponsor and qualifying conditions. The alert is handled through the normal response process. Any crime information goes to the appropriate official reporting route, with no assumption that the historical reward applies.
The useful result is an accurate report and preserved evidence. Reward eligibility remains a separate decision under the sponsor's actual terms.