Mark Eichin and Jon Rochlis at MIT and Gene Spafford at Berkeley did some pretty amazing work, reverse engineering the attack payload on the fly in real-time to regenerate the source C code responsible for the attack while the attack was under way and at a time when no one was doing that sort of work yet.

My favorite part of those efforts was when Spafford posted a tongue in cheek bugfix patch to the attack code midway through the attack (at a time when the only people in the world with the source code were his team, Mark and Jon, and of course RTM since he wrote it). I couldn’t find the patch but it’s somewhere in the RISKS archives from that era.