[Dshield] How Nimda writer sent it?
doug at dwhite.ws
Fri Mar 7 00:41:02 GMT 2003
With Nimbda, the sender address is usually spoofed.
Got DSL? Check it out!
For hosting solutions http://www.clickdoug.com
ISP rated: http://www.forta.com/cf/isp/isp.cfm?isp_id=772
If you are not satisfied with my service, my job isn't done!
----- Original Message -----
From: "sasa s" <compu81baby at yahoo.com>
To: <list at dshield.org>
Sent: Thursday, March 06, 2003 5:12 PM
Subject: [Dshield] How Nimda writer sent it?
| How can any worm writer (as the Nimda writer) send his worm through mail
| i.e. as for Nimda:
| (If the Nimda sender was using his hotmail account 2 send his worm)
| the attachment is an exe
| Content-Type : audio /x- wav;
| name = "readme. exe"
| did he use the "add attachment" button 2 attach his exe?
| if so then how did the writer make it seem to be "x-wav"?
| Did he use ordinary mail client ?
| or how did he send the Nimda?
| Do you Yahoo!?
| Yahoo! Tax Center - forms, calculators, tips, and more
| list mailing list
| list at dshield.org
| To change your subscription options (or unsubscribe), see:
More information about the list