----- Original Message -----
From: Bill Turner <w7ti@dslextreme.com>
>
> _________________________________________________________
>
> I don't think it's really from Jules. Look closely and you'll see an
> underscore in front of Jules' address. All of them I've received so far
> have had the underscore. It's trying to make you think it's from Jules
> and therefore legitimate.
The worm writes email addresses to the %System%\Protocol.dll file to prevent
multiple emails to the same person. Additionally, the sender's email address
will have the "_" character prepended to it, to prevent replying to infected
mails to warn the sender (eg user@website.com becomes _user@website.com).
http://securityresponse.symantec.com/avcenter/venc/data/w32.badtrans.b@mm.ht
ml
Explains it all in great depth. Chau, Eddie.
|