[42637] in North American Network Operators' Group
Re: Re: FW: Worm probes
daemon@ATHENA.MIT.EDU (Frank Coluccio)
Tue Sep 18 15:25:11 2001
From: Frank Coluccio <fcoluccio@dticonsulting.com>
To: rhe@noc.ten-155.net
Cc: MBraun@firstam.com, nanog@merit.edu,
Date: Tue, 18 Sep 2001 18:05:15 GMT
MIME-Version: 1.0
Message-ID: <1000836315.342fcoluccio@dticonsulting.com>
Content-type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
Errors-To: owner-nanog-outgoing@merit.edu
re < readme.exe > :
http://www.cert.org/current/current_activity.html#port80
>
> > There is also an email vector where README.EXE is sent via email to
> > numerous accounts.
>
> It also seems to set the from address in both the envelope and
> header to an address, possibly from the address book(?). I've seen
> a number of bounces come back to one of our NOC addresses, and a
> couple of reports from humans. :(
>
> Rob
>
