Re: Win32.Sircam.Worm Alert.....

From: Brad Cox (bcox@virtualschool.edu)
Date: 07/27/01 

Message-Id: <p05101007b78741ba32d3@[192.168.1.2]>
Date: Fri, 27 Jul 2001 12:06:45 -0400
To: "Juanita Fernando" <jsscn@optushome.com.au>, "Kyle Plate" <kyle@CLASSIFIEDTECHNOLOGIES.COM>, <vuln-dev@securityfocus.com>, <SECURITY-BASICS@securityfocus.com>
From: Brad Cox <bcox@virtualschool.edu>
Subject: Re: Win32.Sircam.Worm Alert.....

At 3:07 PM +1000 7/27/01, Juanita Fernando wrote:
>We were caught by surprise by the virus.. it affected 200 workstations

You didn't know you were using Microsoft servers which are
particularly vulnerable to this kind of stuff?

>before we "caught" it. Vet is on top of it now. As a matter of interest,
>the way we identified suspect file attachments was that those affected seem
>to have two file extensions - eg. "word.doc.bat". This signature enabled us
>to get users involved in its control prior to the VET patch installation
>which deletes it from the server and affected workstations. 

-- 
For industrial age goods there were checks and credit cards.
For everything else there is mybank.dom at http://virtualschool.edu/mybank
Brad Cox, PhD; bcox@virtualschool.edu 703 361 4751

Relevant Pages

  • Re: Word Freezes Trying to Open Documents & Says "Running virus scan..
    ... If you are suffering that error message, then you MUST have a virus scanner that is causing the problem. ... different workstations when trying to open a particular file. ... We are on a domain with a Windows Small Business Server 2003 domain ...
    (microsoft.public.word.application.errors)
  • Re: Best OS for recording
    ... Most workstations are ... It's a LOT harder to get a virus or worm without ... C'est suisse, et tres, tres precis." ... I can't imagine Excel being on a work station. ...
    (rec.audio.pro)
  • Re: Virus Infection
    ... I suspect it may be on your workstations as well, so you may want to unplug ... I'm not be able to remote into my server. ... > Virus scan. ... There is a virus task that will start when the ...
    (microsoft.public.backoffice.smallbiz)
  • Help Client with Many Virus!!!
    ... I have a client with three workstations. ... Last week is was 84 virus, this week the server ... surfing and this user is infecting the network constantly. ...
    (microsoft.public.windows.server.sbs)
  • Re: Server Running EXTREMELY Slow
    ... Please define exactly what constitutes an "unprotected XP workstations". ... that SP1 with no MS fixes or what exactly. ... >> you are free from virus attacks. ... >> infect your server. ...
    (microsoft.public.windows.server.sbs)