[Dshield] How Nimda writer sent it?

Doug White doug at dwhite.ws
Fri Mar 7 00:41:02 GMT 2003


With Nimbda, the sender address is usually spoofed.

======================================
Got DSL?  Check it out!
For hosting solutions http://www.clickdoug.com
ISP rated: http://www.forta.com/cf/isp/isp.cfm?isp_id=772
======================================
If you are not satisfied with my service, my job isn't done!

----- Original Message -----
From: "sasa s" <compu81baby at yahoo.com>
To: <list at dshield.org>
Sent: Thursday, March 06, 2003 5:12 PM
Subject: [Dshield] How Nimda writer sent it?


|
| How can any worm writer (as the Nimda writer) send his worm through mail
client?
|
| i.e. as for Nimda:
|
| (If the Nimda sender was using his hotmail account 2 send his worm)
|
| the attachment is an exe
|
| Content-Type : audio /x- wav;
| name = "readme. exe"
|
| did he use the "add attachment" button 2 attach his exe?
| if so then how did the writer make it seem to be "x-wav"?
| Did he use ordinary mail client ?
| or how did he send the Nimda?
|
|
|
|
|
| ---------------------------------
| Do you Yahoo!?
| Yahoo! Tax Center - forms, calculators, tips, and more
| _______________________________________________
| list mailing list
| list at dshield.org
| To change your subscription options (or unsubscribe), see:
http://www.dshield.org/mailman/listinfo/list
|
|



More information about the list mailing list