Re: Win32.Sircam.Worm Alert.....

From: Bruno Lustosa (bruno@lustosa.net)
Date: 07/25/01 

Date: Wed, 25 Jul 2001 11:46:33 -0300
From: Bruno Lustosa <bruno@lustosa.net>
To: vuln-dev@securityfocus.com, SECURITY-BASICS@securityfocus.com
Subject: Re: Win32.Sircam.Worm Alert.....
Message-ID: <20010725114633.A23239@deskadm.elnethq>

Hello all.

Anyone has any idea on how the "From:" line in the emails SirCam sends is
generated? There seems to be some kind of trickery there.
I received mail from accounts that are purely administrative (for example,
MAILER-DAEMON@somedomain.com).
Did anyone have a look to see how they are got?

[]s

Stan Lee (OBU-MY) [Stan_Lee@trend.com.tw] wrote:
> for more infromation, please visit this site at:
> http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=TROJ_SIRCAM.A 

-- 
Bruno Lustosa, aka Lofofora          | Email: bruno@lustosa.net
Network Administrator/Web Programmer | ICQ UIN: 1406477
Rio de Janeiro - Brazil              |