Bill
Tue Sep 23 15:18:01 CDT 2003
However, there's more--according to F-secure, who I have some faith in:
(You will have noticed the posts referred to in the second paragraph in this
and other newsgroups.)
------------------------------------------
The worm also can search for e-mail addresses in various newsgroups. It
connects to NNTP servers listed in the SWEN1.DAT file, gets a list of all
newsgroups on that server and searches recent messages in these newsgroups
for 'nfrom:' and 'nreply-to:' tags. When such tags are found, the worm gets
e-mail addressed after them and writes them to the GERMS0.DBV file. This way
the worm can harvers a lot of e-mail addresses to send itself to.
The worm can post its e-mails to newsgroups, the names of which it finds
during searching process. The worm sends the same kind of messages as it
sends via e-mail.
-----------------------------------------------------------------------
"helper" <there> wrote in message
news:e8Iv52fgDHA.2268@tk2msftngp13.phx.gbl...
>
http://www.viruslist.com/eng/viruslist.html?id=88029
>
> "The worm scans all disks for files with extensions DBX, MDX, EML, WAB and
> also that contain either HT or ASP in the extension. Swem then extracts
any
> email addresses that it can find and saves them"
>
> That is how it gets the email addresses on infected machines. So if user
had
> newsgroups or emails downloaded locally like most do when you read
messages.
> This virus scans the local folders (.dbx files in Outlook Express) on
> infected machine, and that is how it gets email addresses for its spam.
>
>