RE: Win32.Sircam.Worm Alert.....

From: Eric D. Williams (eric@infobro.com)
Date: 07/25/01 

Message-ID: <01C114F2.46B47FC0.eric@infobro.com>
From: "Eric D. Williams" <eric@infobro.com>
To: 'Martin Lindquist' <martin@phreakproductions.cjb.net>
Subject: RE: Win32.Sircam.Worm Alert.....
Date: Wed, 25 Jul 2001 10:12:12 -0400

Hello all;

It should be noted that the attachment below has a .com extension. I too
received a disabled (truncated) copy of this worm on today 7/25/01 however the
attached file had a .pif extension. I suspect this worm alters extensions as
well, I am sure (and hope) someone will post a dissection of this worm to the
list after they receive a full copy.

Eric Williams, Pres.
Information Brokers, Inc. Phone: +1 202.889.4395
http://www.infobro.com/ Fax: +1 202.889.4396
               mailto:eric@infobro.com
           For More Info: info@infobro.com
                    PGP Public Key
   http://new.infobro.com/KeyServ/EricDWilliams.asc
Finger Print: 1055 8AED 9783 2378 73EF 7B19 0544 A590 FF65 B789

On Tuesday, July 24, 2001 11:14 AM, Martin Lindquist
[SMTP:martin@phreakproductions.cjb.net] wrote:
8<snip-----
> I don't know much spanish, but it looks to me as a direct translation of
> the english version. Subject line was "WOWWWWWWWW" and the attached
> (suspected evil) file is named "WOWWWWWWWW.doc.com".
>
> / Martin Lindquist
>
8<snip----
> --
> email:marine@trouble.net
> email:martin@phreakproductions.cjb.net
> phone:+46-70-490 79 03

Relevant Pages

  • Re: vbscript script file
    ... Creates a new file with extension .VBS. ... I-Worm.LoveLetter is Internet worm written in the scripting language ... Windows Scripting Host is installed. ... Overwrites files with the worm body. ...
    (microsoft.public.windowsxp.general)
  • Re: Hello, M.Cur, Returned mail--
    ... like a virus or a worm (the actual extension is PIF). ...
    (microsoft.public.exchange2000.admin)