Posted by MoparNorm on Tuesday, February 03, 2004 at 7:29AM :
In Reply to: Re: CLint.... posted by Clint Dixon on Tuesday, February 03, 2004 at 7:14AM :
FYI' From the Symantec website;
"Attempts to send email messages using its own SMTP engine. The worm looks up the mail server that the recipient uses before sending the email. If it is unsuccessful, it will use the local mail server instead. The email will have the following characteristics:
From: The "From" address may be spoofed.
Subject: The subject will be one of the following:
test
hi
hello
Mail Delivery System
Mail Transaction Failed
Server Report
Status
Error
Message: The message will be one of the following:
Mail transaction failed. Partial message is available.
The message contains Unicode characters and has been sent as a binary attachment.
The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.
test
Attachment: The attachment file name, not including the extension, will be one of the following:
document
readme
doc
text
file
data
test
message
body
The attached file may have either one or two file extensions. If it does have two, the first extension will be one of the following:
.htm
.txt
.doc
The second extension, or the only extension if there is only one, will be one of the following:
.pif
.scr
.exe
.cmd
.bat
.zip (This is an actual .zip file that contains a copy of the worm, sharing the same file name as the .zip. For example, readme.zip can contain readme.exe.)
If the worm has an extension of .exe or .scr, the file will be displayed with the following icon:..."
MN
Follow Ups: