Date: Wed, 25 Jul 2001 17:27:06 -0400 From: James Housley <jim@thehousleys.net> To: Rick Hamell <hamellr@heorot.1nova.com> Cc: Wm Brian McCane <root@mccons.maxbaud.net>, freebsd-isp@freebsd.org Subject: Re: Possible spammers with a virus Message-ID: <3B5F39AA.95B7580B@Thehousleys.net> References: <Pine.BSF.4.21.0107251408240.21810-100000@heorot.1nova.com>
index | next in thread | previous in thread | raw e-mail
[-- Attachment #1 --] Rick Hamell wrote: > > Apparently... the virus is somehow picking up email addresses off > of web pages... a friend is being hit hard with it and that's the only > place we can figure it's coming from. > >From (http://www.f-secure.com/v-descs/sircam.shtml) The worm uses Windows Address Book to collect e-mail addresses ('*.wab files). The worm also tries to look for e-mail addresses in \Temporary Internet Files\ folder ('sho*', 'get*', 'hot*', '*.html'). If a user has a working e-mail account the worm reads the its setting. Otherwise the '[username]@prodigy.mx.net' is used as the default sender's address and 'prodigy.net.mx' is used for the SMTP server name. The worm has its own SMTP engine and it sends out messages using this engine. Jim -- /"\ ASCII Ribbon Campaign . \ / - NO HTML/RTF in e-mail . X - NO Word docs in e-mail . / \ ----------------------------------------------------------------- jeh@FreeBSD.org http://www.FreeBSD.org The Power to Serve jim@TheHousleys.Net http://www.TheHousleys.net --------------------------------------------------------------------- Unix is like a wigwam -- no Gates, no Windows, and an Apache inside. [-- Attachment #2 --] 0 *H 01 0 + 0 *H 00%L"0 *H 01 0 UZA10U Western Cape10U Durbanville10 U Thawte1 0U Certificate Services1(0&U Personal Freemail RSA 1999.9.160 000921154029Z 010921154029Z0^10UHousley10 U*James10U James Housley1"0 *H jim@thehousleys.net00 *H 0 +hvȦi;sb&[ŔGF[0㩌O#jdFoCs:X0IZzm&,' 'L#˦xA0c<B A<"3m k Q0O0 U 0jim@thehousleys.net0 U 0 0 U #0`fUXF a#Ì0 *H Ue|̕^.3.on%j{ -37vDkx^o9hsIJTVjcG.j߄@~ІU!)ȷKE +QKfnɵB#庝o00} 0 *H 01 0 UZA10U Western Cape10U Cape Town10U Thawte Consulting1(0&U Certification Services Division1$0"UThawte Personal Freemail CA1+0) *H personal-freemail@thawte.com0 990916140140Z 010915140140Z01 0 UZA10U Western Cape10U Durbanville10 U Thawte1 0U Certificate Services1(0&U Personal Freemail RSA 1999.9.1600 *H 0 iZ z]!#rLK~r$BRW{azr98e^eyvL>hpu t ,O 1ArƦ]D.Mօ>lx~@эWs0FO 7050U 0 0 U #0rIs4U vr~wƲ0 *H kY1rr`HU{gapm¥7؝(V\uoƑlfq|ko!6- -mƃRt\~ orzg,ks n Νc) ~U10001 0 UZA10U Western Cape10U Durbanville10 U Thawte1 0U Certificate Services1(0&U Personal Freemail RSA 1999.9.16L"0 + 0 *H 1 *H 0 *H 1 010725212706Z0# *H 10Z-AtD]0R *H 1E0C0 *H 0*H 0+0 *H @0 *H (0 *H w|u925wIZmj/Q &^@ 0 ~Ee%2O!z.@$Pt =6B)I>ԫ)6,>ʫ漻b<!U5,Zgs쩘help
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3B5F39AA.95B7580B>