RE: Virus warning

["Ari Nepon" <arnepon ursinus edu>]

Search for Sirc32 on Google, or on symantec's website. There is a free virus
removal tool for that virus. I already fixed a couple of people's computers
that had it. The virus is a powerful one. It comes with its own smtp engine
and sends out itself to every email address that is in your cache folder
(i.e. every email address on every website that you have viewed). It will
also fill up your HD and eventually crash you repeatedly.



-----Original Message-----
From: redhat-install-list-admin redhat com
[mailto:redhat-install-list-admin redhat com]On Behalf Of Steve
Fernandez
Sent: Wednesday, July 25, 2001 10:34 AM
To: Ajith Kumar R; Ali K; ALL; Amal Chandran; Anand Swaminathan; Ann
Meril Tom; Arjun; Ashok Chandran; Asif Iqbal Mooppan; Aysha Hasna; Biby
Kuriakose; Bindia George; Bittu Biji Eappen; Bliss Cyriac; Brinda
Ramachandran; Danilin Franlklin; Deepak Surie; Dhinu Johnson; Dilip
Baba; Fr. Joseph Van Leuwen; Fr. Ken Breen; Harish G; HOME; Issac John;
Janosh George; Java - Linux; Jeny; Jeny Jose; Jinu Thomas; Jisha Thomas;
Joel Baby; Joseph Vinish D'silva; Juby Jacob; Kaffe; Kalum; Karthik
Sharma; Kasthuri Pillai; Kavya Gopi; Lawrence Jude Almeida; Lifin T H;
Liju Rose; Mahesh Sarma; Malcolm Oliver; Malini Nair; Meera Joseph;
Meghna N B; Neelima Balakrishnan; Neena Thomas; Neil Barnard; Nirmal
Unnikrishnan; Nithin John; Prem; Prof. P. C. Thomas; R. K. Ajay; Ramesh
N; Ranjith K. Y.; Ranjitha Raja; Reshma Ramdas; Reshmi C. S.; RHL
Developers; RHL Install; RHL List; Riya Raju; Ronny; Roshni Firoz; Sajin
Mathew; Sanish N. S.; Shabana M; Shiney Subhas; Shyam Kumar; Siby R
Subhagan; Soji V. P.; Soumya G Nair; Sreejith S.; Sreevisakh V. G.;
Sudheesh Suresh; Sumi Panicker; Susan George; Teena T. Rani; Thomman
Korah; Vijay Venoo Thampy; Siraj Sir
Subject: Virus warning


        I found a virus on my system today, probably a new one, which
bypassed all my antivirus software, and since all of you have your email
ids in my address book, you all are potential targets, and so I'm
sending this warning to you.

        I received this virus twice in the past two days, from two
people completely unknown to me. The virus selects a random subject each
time it retransmits itself, but I've got the same message content on the
two occasions. The message content is:-


"Hi! How are you?

I send you this file in order to have your advice

See you later. Thanks"


        After receiving this email, which has an attachment about
120-140 KB in size, I noticed unnecessary traffic over my internet
connection. Also, two new threads, called Sirc32 and pstores, showed up
on the system (does not appear in the CTRL+ALT+DEL task list) When I
searched in my registry, I found that HKEY_LOCAL_MACHINE - Software -
Microsoft - Windows - CurrentVersion - Run (it's in one of the Run*
folders) has a key called "Driver32" which instructs my system to run a
file called C:\RECYCLED\TEST.EXE (you will find two .EXE files hidden in
your C:\RECYCLED directory) I have removed all these files from my
system. I advise you to take a backup before you do anything.

Good Luck.

Regards,
Steve Fernandez.