Re: Win32.Sircam.Worm Alert.....

From: horape@tinuviel.compendium.net.ar
Date: 07/25/01 

Date: Wed, 25 Jul 2001 00:50:30 -0300
From: horape@tinuviel.compendium.net.ar
To: Martin Lindquist <martin@phreakproductions.cjb.net>
Subject: Re: Win32.Sircam.Worm Alert.....
Message-ID: <20010725005030.A31089@tinuviel.compendium.net.ar>

¡Hola!

> Today I received two e-mails with the mentioned attachments, although
> from people I have never heard of before. Since I'm fighting SPAM every
> single day, I don't open attachments in e-mails from unknown senders
> (some people seem too happy to get e-mail and think everyone who sends
> them one is a good guy), but I recognised the text and thought I'd drop
> a line about the e-mail I received a couple of days ago, more precisely
> Thursday 19th. It's the same mail, with one big difference; it's in
> spanish:
>
> | Hola como estas ?

Hi, how are you?

> | Te mando este archivo para que me des tu punto de vista

I'm attaching that file so you comment on it.

> | Nos vemos pronto, gracias.

See you, thanks. 

---

There are several versions in each language.

> I don't know much spanish, but it looks to me as a direct translation of
> the english version. Subject line was "WOWWWWWWWW" and the attached
> (suspected evil) file is named "WOWWWWWWWW.doc.com".

It seems to take the filename from a file in the victim, and copy that name
to the subject.

>  / Martin Lindquist

Saludos,
					HoraPe
---
Horacio J. Peña
horape@compendium.com.ar
horape@uninet.edu
bofh@puntoar.net.ar
horape@hcdn.gov.ar