RE: Win32.Sircam.Worm Alert.....
From: Craig Leikis (cleikis@superpages.com)Date: 07/26/01
- Previous message: Chris Freels: "RE: Win32.Sircam.Worm Alert....."
- In reply to: Jeremy Rodriguez: "RE: Win32.Sircam.Worm Alert....."
- Next in thread: Kimberly Anne McKinnis: "Re:Sircam"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Thu, 26 Jul 2001 06:05:37 -0500 (CDT) From: Craig Leikis <cleikis@superpages.com> To: Jeremy Rodriguez <jrodriguez@intellinet-tech.com> Subject: RE: Win32.Sircam.Worm Alert..... Message-ID: <Pine.GSO.4.33.0107260601050.22564-100000@manx.superpages.com>
I have received several messages with this worm through yahoo! mail.
Fortunately, Yahoo! includes a feature to have Norton Anti-virus scan
attachments before you download them. The first message I received before
I heard about the worm looked suspect anyway and I was going to delete it.
I scanned it for the heck of it and sure enough it was the sircam worm.
Craig
On Wed, 25 Jul 2001, Jeremy Rodriguez wrote:
> Yesterday the worm infected 3 of our systems. Just to test I downloaded it,
> save it a specific folder and scanned it with Norton's (using the latest
> defs) and to my suprise it did not pick it up.
> The fix Symantec has:
> http://www.sarc.com/avcenter/FixSirc.com
>
> Did find the worm and repair it.
>
>
> -----Original Message-----
> From: Tom Geldner [mailto:tom@xor.cc]
> Sent: Tuesday, July 24, 2001 12:35 PM
> To: 'Johnson, Greg'; vuln-dev@securityfocus.com;
> SECURITY-BASICS@securityfocus.com
> Subject: RE: Win32.Sircam.Worm Alert.....
>
>
>
>
> >-----Original Message-----
> >From: Johnson, Greg [mailto:JohnsonG@missouri.edu]
>
> >Don't let the e-mail tip-off fool you.
> >
> >In our University environment we find this and related worms
> >spread primarily via unprotected writeable Windows shares. It
> >also gets in when a user without up-to-date anti-virus
> >software accesses an e-mail server other than our own which
> >has an anti-virus filter. Bim-ba-boom!
>
> Some of our corporate accounts have been pounded on by a particular user
> on verizon.net. None of those e-mail addresses are from someone's
> address book. They are all things like info@, webmaster@, postmaster@
> etc. so in our case, someone seems to be trying to propogate it
> deliberately.
>
> Tom
>
- Previous message: Chris Freels: "RE: Win32.Sircam.Worm Alert....."
- In reply to: Jeremy Rodriguez: "RE: Win32.Sircam.Worm Alert....."
- Next in thread: Kimberly Anne McKinnis: "Re:Sircam"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
