SirCam Virus is Running Amuck

From: EdGrenda@aol.com
Date: Thu Aug 02 2001 - 19:53:23 EEST


Hi Folks:

It's been mentioned here before, but maybe it can't be emphasized enough that
a really bad worm virus is going around. In the last few days I have
received about 30 email messages and attachments that begin approximately:

>>
Hi! How are you?
 
I send you this file in order to have your advice
 
See you later. Thanks

>>

This is accompanied by a random file attachment with a double extension.

DO NOT OPEN THE FILE, (but some email programs automatically do it anyway.)

When executed, the worm modifies your Windows registry and sends itself with
a random file from your "My documents" folder to random email addresses in
your address book. You will not know that it is doing this because it has
its own means of connecting to the web in parallel using an internal SMTP
engine. It can also make for serious problems locally, locking up your
machine and wreaking considerable havoc, judging by the war stories I've been
reading on the web. Here's one place that has a description and tools:

http://www.commandcom.com/virus/sircam.html

Some of you definitely have it because I've received copies from people on
the list. Look in your windows directory for SCAM32.EXE and in your recycle
bin for SIRC32.EXE.

It's a jungle out there...

Ed Grenda
Castle Island Co.
781-646-6280 (voice or fax)
EdGrenda@aol.com (email)
http://home.att.net/~castleisland/

For more information about the rp-ml, see http://rapid.lpt.fi/rp-ml/



This archive was generated by hypermail 2.1.2 : Fri Jan 04 2002 - 09:57:35 EET