Quoting Sean Reifschneider ([EMAIL PROTECTED]):
> Anyone else seeing thousands of messages filling up your queue, apparently
> from "[EMAIL PROTECTED]" to addresses such as:
>
> [EMAIL PROTECTED]
I'm pretty sure this is the work of the W95.Hybrid email worm (the
sexyfun.net one), sending copies of itself to the mail2news gateway
for distribution to news servers worldwide, so that other infected
computers can download new plugins. That sure is a nasty bugger.
One or more of your users is undoubtedly infected with the
worm--plenty of ours are, I'm sorry to say.
It would seem that when it was discovered that worm authors intended
to use them for worm distribution, the administrators of that gateway
shut it down. One point to the miscreants.
Aaron
