Date: Wed, 25 Jul 2001 17:27:06 -0400 From: James Housley <jim@thehousleys.net> To: Rick Hamell <hamellr@heorot.1nova.com> Cc: Wm Brian McCane <root@mccons.maxbaud.net>, freebsd-isp@freebsd.org Subject: Re: Possible spammers with a virus Message-ID: <3B5F39AA.95B7580B@Thehousleys.net> References: <Pine.BSF.4.21.0107251408240.21810-100000@heorot.1nova.com>
next in thread | previous in thread | raw e-mail | index | archive | help
This is a cryptographically signed message in MIME format. --------------msDEFB40B1CC37695BBE3D9023 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Rick Hamell wrote: > > Apparently... the virus is somehow picking up email addresses off > of web pages... a friend is being hit hard with it and that's the only > place we can figure it's coming from. > >From (http://www.f-secure.com/v-descs/sircam.shtml) The worm uses Windows Address Book to collect e-mail addresses ('*.wab files). The worm also tries to look for e-mail addresses in \Temporary Internet Files\ folder ('sho*', 'get*', 'hot*', '*.html'). If a user has a working e-mail account the worm reads the its setting. Otherwise the '[username]@prodigy.mx.net' is used as the default sender's address and 'prodigy.net.mx' is used for the SMTP server name. The worm has its own SMTP engine and it sends out messages using this engine. Jim -- /"\ ASCII Ribbon Campaign . \ / - NO HTML/RTF in e-mail . X - NO Word docs in e-mail . / \ ----------------------------------------------------------------- jeh@FreeBSD.org http://www.FreeBSD.org The Power to Serve jim@TheHousleys.Net http://www.TheHousleys.net --------------------------------------------------------------------- Unix is like a wigwam -- no Gates, no Windows, and an Apache inside. --------------msDEFB40B1CC37695BBE3D9023 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIIBwYJKoZIhvcNAQcCoIIH+DCCB/QCAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3DQEHAaCC BdgwggK8MIICJaADAgECAgMDTCIwDQYJKoZIhvcNAQEEBQAwgZQxCzAJBgNVBAYTAlpBMRUw EwYDVQQIEwxXZXN0ZXJuIENhcGUxFDASBgNVBAcTC0R1cmJhbnZpbGxlMQ8wDQYDVQQKEwZU aGF3dGUxHTAbBgNVBAsTFENlcnRpZmljYXRlIFNlcnZpY2VzMSgwJgYDVQQDEx9QZXJzb25h bCBGcmVlbWFpbCBSU0EgMTk5OS45LjE2MB4XDTAwMDkyMTE1NDAyOVoXDTAxMDkyMTE1NDAy OVowXjEQMA4GA1UEBBMHSG91c2xleTEOMAwGA1UEKhMFSmFtZXMxFjAUBgNVBAMTDUphbWVz IEhvdXNsZXkxIjAgBgkqhkiG9w0BCQEWE2ppbUB0aGVob3VzbGV5cy5uZXQwgZ8wDQYJKoZI hvcNAQEBBQADgY0AMIGJAoGBAMvwiLzwK732uOEUqWh2yKZpO/Vz5Yfq1xn0uOxi7CZbxZRH RoNbMOOpjOKR8k8jsK9q92SERm/BQ7bpc9Hc6+n0/TpYMKBJWnpt95cm2yyHnycgHd3LJ9QP vUzvI8umjXhBMKDa32OPPEIcrqTpnf3cQTyyIjNtDJOda+cgmo4NAgMBAAGjUTBPMB4GA1Ud EQQXMBWBE2ppbUB0aGVob3VzbGV5cy5uZXQwDAYDVR0TAQH/BAIwADAfBgNVHSMEGDAWgBSI q/Fgg2ZV9ORYx0YdwGG9I9fDjDANBgkqhkiG9w0BAQQFAAOBgQBVuNZlfOrMlcz0XsGClvQu M/EusYBvbiVqwXu5HC0Gt/6JMxnK8jeYlXYTB0TO9KFreF4GvtlvOWic9gFzSUpUVssVrvZq scrmY0f9LsFq34RAftDQhqVVnCEpyLdLRRwLuisQUUtm/H/Ux89ur8m1ocwalf9CI4rlup3B owRvGTCCAxQwggJ9oAMCAQICAQswDQYJKoZIhvcNAQEEBQAwgdExCzAJBgNVBAYTAlpBMRUw EwYDVQQIEwxXZXN0ZXJuIENhcGUxEjAQBgNVBAcTCUNhcGUgVG93bjEaMBgGA1UEChMRVGhh d3RlIENvbnN1bHRpbmcxKDAmBgNVBAsTH0NlcnRpZmljYXRpb24gU2VydmljZXMgRGl2aXNp b24xJDAiBgNVBAMTG1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBDQTErMCkGCSqGSIb3DQEJ ARYccGVyc29uYWwtZnJlZW1haWxAdGhhd3RlLmNvbTAeFw05OTA5MTYxNDAxNDBaFw0wMTA5 MTUxNDAxNDBaMIGUMQswCQYDVQQGEwJaQTEVMBMGA1UECBMMV2VzdGVybiBDYXBlMRQwEgYD VQQHEwtEdXJiYW52aWxsZTEPMA0GA1UEChMGVGhhd3RlMR0wGwYDVQQLExRDZXJ0aWZpY2F0 ZSBTZXJ2aWNlczEoMCYGA1UEAxMfUGVyc29uYWwgRnJlZW1haWwgUlNBIDE5OTkuOS4xNjCB nzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAs2lal9TQFgt6tcVd6SGcI3LNEkxL937Px/vK ciT0QlKsV5Xje2F6F4Tn/XI5OJS06u1lp5IGXr3gZfYZu5R5dkw+uWhwdYQc9BF0ALwFLE8J AxcxzPRB1HLGpl3iiESwiy7ETfHw1oU+bPOVlHiRfkDpnNGNFVeOwnPlMN5G9U8CAwEAAaM3 MDUwEgYDVR0TAQH/BAgwBgEB/wIBADAfBgNVHSMEGDAWgBRyScJzNMZV9At2coF+d/SH58ay DjANBgkqhkiG9w0BAQQFAAOBgQBrxlnpMfrptuyxA9jfcnL+kWBI6sZV3XvwZ47GYXDnbcKl N9idtxcoVgWL3Vx1b8aRkMZsZnET0BB8a5FvhuAhNi3B1+qyCa3PLW3Gg1Kb+7v+nIed/Lfp dJLkXJeu/H6syg1vcnpnLGtz9Yb5nfUAbvQdB86dnoJjKe+TCX5V3jGCAfcwggHzAgEBMIGc MIGUMQswCQYDVQQGEwJaQTEVMBMGA1UECBMMV2VzdGVybiBDYXBlMRQwEgYDVQQHEwtEdXJi YW52aWxsZTEPMA0GA1UEChMGVGhhd3RlMR0wGwYDVQQLExRDZXJ0aWZpY2F0ZSBTZXJ2aWNl czEoMCYGA1UEAxMfUGVyc29uYWwgRnJlZW1haWwgUlNBIDE5OTkuOS4xNgIDA0wiMAkGBSsO AwIaBQCggbEwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMDEw NzI1MjEyNzA2WjAjBgkqhkiG9w0BCQQxFgQUuqEOzTCthlotQcl0vc8ZRF2U/bIwUgYJKoZI hvcNAQkPMUUwQzAKBggqhkiG9w0DBzAOBggqhkiG9w0DAgICAIAwBwYFKw4DAgcwDQYIKoZI hvcNAwICAUAwDQYIKoZIhvcNAwICASgwDQYJKoZIhvcNAQEBBQAEgYAEd3x17be7F4PxFqbj iBnHOTI1+ZyYvXcZCIdJWvDqbWrL2v4vowJRHxGozSa4XgPDQBsNMA3o9n5FZSXqMk8hei6K QCRQ8XQIkB89NrDiQn/gtCnAST4T1Ku2Dr1/KYU2LD4SBMqr5ry7lGI8IVU1LLTQ9opaZ/7F EHMYj+ypmA== --------------msDEFB40B1CC37695BBE3D9023-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-isp" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3B5F39AA.95B7580B>