[42593] in North American Network Operators' Group
Re: FW: Worm probes
daemon@ATHENA.MIT.EDU (Rob Evans)
Tue Sep 18 12:05:27 2001
Date: Tue, 18 Sep 2001 16:54:44 +0100
From: Rob Evans <rhe@noc.ten-155.net>
To: "Braun, Mike" <MBraun@firstam.com>
Cc: "'nanog@merit.edu'" <nanog@merit.edu>
Message-ID: <20010918165444.U2352@whit.ja.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <F16E03C431B5D211893000104BC5C1A70BC168A3@powaymail.credco.firstam.com>; from MBraun@firstam.com on Tue, Sep 18, 2001 at 08:33:36AM -0700
Errors-To: owner-nanog-outgoing@merit.edu
> There is also an email vector where README.EXE is sent via email to
> numerous accounts.
It also seems to set the from address in both the envelope and
header to an address, possibly from the address book(?). I've seen
a number of bounces come back to one of our NOC addresses, and a
couple of reports from humans. :(
Rob
