Path: ccsf.homeunix.org!ccsf.homeunix.org!news1.wakwak.com!nf1.xephion.ne.jp!onion.ish.org!onodera-news!Q.T.Honey!komachi.sp.cs.cmu.edu!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!sn-xit-03!sn-xit-06!sn-xit-01!sn-xit-09!supernews.com!postnews1.google.com!not-for-mail From: jurgensky@gmx.de (-_- Kirsch) Newsgroups: fj.life.in-japan Subject: Re: Mass-mailing virus overload! Date: 19 Sep 2003 20:34:46 -0700 Organization: http://groups.google.com/ Lines: 15 Message-ID: References: NNTP-Posting-Host: 211.3.94.102 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-Trace: posting.google.com 1064028887 25815 127.0.0.1 (20 Sep 2003 03:34:47 GMT) X-Complaints-To: groups-abuse@google.com NNTP-Posting-Date: 20 Sep 2003 03:34:47 GMT Xref: ccsf.homeunix.org fj.life.in-japan:5546 According to Symantec; Transmission through newsgroups The worm will enumerate the registry looking for newsgroup server addresses, then attempt to contact that newsgroup server. If no newsgroup server is configured on the system, the worm will randomly select one from a predefined list. The worm will download the available groups and post messages to randomly selected groups. The messages posted to the newsgroups are generated according to the same routine utilized for email sending. http://securityresponse.symantec.com/avcenter/venc/data/w32.swen.a@mm.html -- jurgen