hi guys,

> do you have any proofs that the worm really scans WWW pages, searching
> for e-mail addresses?
i think bruce is (at least partially) right.

i used one e-mail address for the posting / receiving mails from netbsd 
maillists. then the virus infected mails started to come. i then moved 
to another organization and got new e-mail. i changed my subscription, 
because the old address would be probably cancelled. after posting 1-2 
messages i started to get (after a day or so) these e-mails in number 
~100 per day, too.

maybe it isn't a proof for you, but at least is VERY suspicious and 
weird... how would it be possible that the virus was delivered on my 1 
day old address? i think at that time there were ~5 people outside the 
netbsd-maillists-community who knew this address! and probably another 
indication... no one of my 10 colleagues (not subscribed to the list) 
get these virus infected e-mails...

lubos

-- 
#####################################################
Mgr. Lubos Vrbka

Center for Complex Molecular Systems and Biomolecules
J. Heyrovsky Institute of Physical Chemistry
Academy of Sciences of the Czech Republic
Prague, Czech Republic

http://www.jh-inst.cas.cz/~vrbka
#####################################################