Quoting Marco Cimarosti <[EMAIL PROTECTED]>: > Antoine Leca wrote: > > The virus cannot have any knowledge of a language code. And > > much less of the language used by its next victim... > > It sends e-mails to addresses stolen from the previous victim's address > list, so it can analyze the top-level domain of these addresses (".it", > ".fr", etc.). Although, strictly speaking, these domains normally correspond > to *country* codes, they are a pretty good hint of the language of the next > victim.
An extremely good hint given that the goal is to infect as many machines as possible as quickly as possible, anything that gets more than 50% accuracy should be considered a successful approach in that context. If the authorities find the author I doubt the robustness of the content-language heuristic will be top of the list of things they want to discuss. -- Jon Hanna <http://www.hackcraft.net/> "…it has been truly said that hackers have even more words for equipment failures than Yiddish has for obnoxious people." - jargon.txt