RE: Win32.Sircam.Worm Alert.....

From: Chris Freels (cfreels@gracenote.com)
Date: 07/26/01 

Subject: RE: Win32.Sircam.Worm Alert.....
Date: Thu, 26 Jul 2001 14:09:37 -0700
Message-ID: <721B08CE47DD70479B71E27DFAE4A15B0173E8@Mail1.gracenote.gracenote.com>
From: "Chris Freels" <cfreels@gracenote.com>
To: <vuln-dev@securityfocus.com>, <SECURITY-BASICS@securityfocus.com>

I have been seeing this virus come through my Exchange 2000 server for
the last week. The first day I saw the alert I was receiving it. I am
running McAfee Groupshield for Exchange 2000 SP1 and it is working just
fine. I have not gotten one infected machine. We are running scan
engine 4140 with the latest DAT.

Chris

-----Original Message-----
From: Kyle Plate [mailto:kyle@CLASSIFIEDTECHNOLOGIES.COM]
Sent: Wednesday, July 25, 2001 3:04 PM
To: 'vuln-dev@securityfocus.com'; 'SECURITY-BASICS@securityfocus.com'
Subject: RE: Win32.Sircam.Worm Alert.....

FYI:

Using Symantec's NAV for Exchange (Virus def: 7/18/01 12:00am) has been
successful for us in detecting and moving to quarantine all Sircam
infected
messages that have been sent to our server.

-----Original Message-----
From: Jeremy Rodriguez [mailto:jrodriguez@intellinet-tech.com]
Sent: Wednesday, July 25, 2001 9:19 AM
To: Tom Geldner; 'Johnson, Greg'; vuln-dev@securityfocus.com;
SECURITY-BASICS@securityfocus.com
Subject: RE: Win32.Sircam.Worm Alert.....

Yesterday the worm infected 3 of our systems. Just to test I downloaded
it,
save it a specific folder and scanned it with Norton's (using the latest
defs) and to my suprise it did not pick it up.
The fix Symantec has:
http://www.sarc.com/avcenter/FixSirc.com

Did find the worm and repair it.

Relevant Pages

  • RE: Health monitor not sending alerts
    ... What if the SMTP service crashed on the server how would the alert be sent ... > receive the alert if the Exchange has been crashed. ...
    (microsoft.public.windows.server.sbs)
  • RE: Win32.Sircam.Worm Alert.....
    ... eSafe, Norton Antivirus, F-Secure, Sophos and ... > running McAfee Groupshield for Exchange 2000 SP1 and it is working just ... > messages that have been sent to our server. ...
    (Security-Basics)
  • Re: Store.exe process is allocating more memory
    ... That is simply an alert, no big deal unless your server is having ... The store.exe process is allocating more memory than usual. ... restart the Microsoft Exchange Information Store service. ...
    (microsoft.public.windows.server.sbs)
  • Re: Exchange Problem
    ... That is as a result of Exchange 2003 SP1, and some differences in the way ... > I have an Exchange issue under Health Monitor state as ... > Small Business Server Alert ...
    (microsoft.public.windows.server.sbs)
  • Re: Procees store
    ... Update for Integration Issues Caused by Exchange Server 2003 Service Pack 1 ... Javier [SBS MVP] ... > You can disable this alert or change its threshold by using the Change ...
    (microsoft.public.windows.server.sbs)