RE: Win32.Sircam.Worm Alert.....

From: Tom Geldner (tom@xor.cc)
Date: 07/24/01 

From: "Tom Geldner" <tom@xor.cc>
To: "'Johnson, Greg'" <JohnsonG@missouri.edu>, <vuln-dev@securityfocus.com>, <SECURITY-BASICS@securityfocus.com>
Subject: RE: Win32.Sircam.Worm Alert.....
Date: Tue, 24 Jul 2001 09:34:35 -0700
Message-ID: <004101c1145e$8755c0f0$0100a8c0@bosco>

>-----Original Message-----
>From: Johnson, Greg [mailto:JohnsonG@missouri.edu]

>Don't let the e-mail tip-off fool you.
>
>In our University environment we find this and related worms
>spread primarily via unprotected writeable Windows shares. It
>also gets in when a user without up-to-date anti-virus
>software accesses an e-mail server other than our own which
>has an anti-virus filter. Bim-ba-boom!

Some of our corporate accounts have been pounded on by a particular user
on verizon.net. None of those e-mail addresses are from someone's
address book. They are all things like info@, webmaster@, postmaster@
etc. so in our case, someone seems to be trying to propogate it
deliberately.

Tom