Re: Virus warning

["Tyler Nally" <tnally iquest net>]

This is a particularly bad internet worm that installs it's  own
SMTP server on your machine and then starts e-mail those that are
referred to in documents and your local address book with the message
you described below *attached* to files that exist in your local
"My Documents" directory.

I've several times now received messages (glad I didn't open any of them) 
from two different e-mail addresses on the 'net that I've no clue as to
who they are.  One has sent me megabytes of documents w/ the SirCam 
worm built into it and another has only sent me two pieces of e-mail.


More can be read at ...

    http://www.sarc.com/avcenter/venc/data/w32 sircam worm mm html

.. about the worm/virus.  It really is a nasty one.  The friendly
folks at www.sarc.com (Symmantec Antivirus Research Center) rate
this one a "4" because of it's fast spreadability.  A 4 is quite a
bit worse than most of the offending viri out there. 

Tyler

----- Original Message ----- 
From: "Ramesh Narayanaswamy" <lellan eth net>

Sent: Wednesday, July 25, 2001 2:36 PM
Subject: Re: Virus warning


> Hey Steve man...
> 
> Thanks a lot for the warning. I'm sure it'll serve more than a "digitally
> signed Steve message" to all who have been (un)fortunate enough to be in
> your Address Book. If you haven't already done this, install a good firewall
> (I strongly recommend ZoneAlarm) so that you have complete control of your
> Internet Activity. Plus, if you feel like it, get CookieMuncher v3.7 -- it
> does what it says it does. ;-) (Unless you intend on researching on the
> potentially dangerous properties of Net-Sensitive viri)
> 
> I depart, O Traveller, with a simple message -- "Verbum Sapienti" (long
> story behind the message, ring/e-mail/talk for further details).
> 
> Cheers,
> Ramesh
> "For the love of life."
> 
> 
> ----- Original Message -----
> From: "Steve Fernandez" <franline eth net>
> Sent: Wednesday, July 25, 2001 8:03 PM
> Subject: Virus warning
> 
> 
> >         I found a virus on my system today, probably a new one, which
> > bypassed all my antivirus software, and since all of you have your email
> > ids in my address book, you all are potential targets, and so I'm
> > sending this warning to you.
> >
> >         I received this virus twice in the past two days, from two
> > people completely unknown to me. The virus selects a random subject each
> > time it retransmits itself, but I've got the same message content on the
> > two occasions. The message content is:-
> >
> >
> > "Hi! How are you?
> >
> > I send you this file in order to have your advice
> >
> > See you later. Thanks"
> >
> >
> >         After receiving this email, which has an attachment about
> > 120-140 KB in size, I noticed unnecessary traffic over my internet
> > connection. Also, two new threads, called Sirc32 and pstores, showed up
> > on the system (does not appear in the CTRL+ALT+DEL task list) When I
> > searched in my registry, I found that HKEY_LOCAL_MACHINE - Software -
> > Microsoft - Windows - CurrentVersion - Run (it's in one of the Run*
> > folders) has a key called "Driver32" which instructs my system to run a
> > file called C:\RECYCLED\TEST.EXE (you will find two .EXE files hidden in
> > your C:\RECYCLED directory) I have removed all these files from my
> > system. I advise you to take a backup before you do anything.
> >
> > Good Luck.
> >
> > Regards,
> > Steve Fernandez.
> 
> 
> 
> _______________________________________________
> Redhat-install-list mailing list
> Redhat-install-list redhat com
> https://listman.redhat.com/mailman/listinfo/redhat-install-list
>