FW: Worm probes

Tue Sep 18 18:05:15 UTC 2001

re  < readme.exe > :

http://www.cert.org/current/current_activity.html#port80

> 
> > There is also an email vector where README.EXE is sent via email to
> > numerous accounts.  
> 
> It also seems to set the from address in both the envelope and
> header to an address, possibly from the address book(?).  I've seen
> a number of bounces come back to one of our NOC addresses, and a
> couple of reports from humans. :(
> 
> Rob
>