According to this page, the link will vary, because it is pointing back to the infected PC.
http://www.sophos.com/virusinfo/articles/howbofrawork.html


PS This also means that the usual way to "Fix" one of these, send only the link (no attachment) is to shut down the few hosting web sites world wide and bang the pest is dead.
But not this time. We can hope that at least some of the PC's are protected by Firewalls or Cable routers that will prevent this kind of connection. Also some ISPs stop home accounts from hosting websites (by blocking some protocols), this might help also. But I expect we will hear a lot more on these in the coming weeks.


Greg Little


John Tolmachoff (Lists) wrote:

Any one know what the link in the body is so we can add filters for it?




---
[This E-mail scanned for viruses by Findlay Internet]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".    The archives can be found
at http://www.mail-archive.com.

Reply via email to