Re: Re: FW: Worm probes

[Frank Coluccio <fcoluccio () dticonsulting com>]

re  < readme.exe > :

http://www.cert.org/current/current_activity.html#port80

> > There is also an email vector where README.EXE is sent via email to
> > numerous accounts.  
>
> It also seems to set the from address in both the envelope and
> header to an address, possibly from the address book(?).  I've seen
> a number of bounces come back to one of our NOC addresses, and a
> couple of reports from humans. :(
>
> Rob