This is the real deal guys. My wife's association was bombarded when a
member opened the thing and it attacked her entire membership mailing
list-talk about exponential growth!
Bill Uffelman
Hi guys - pardon this intrusion, but Dave said that this was a
serious enough threat that our A-V manufacturer has notified all
subscribers via email, in advance of a forthcoming update.
FYI - take care. Note that this would likely NOT get transmitted from any
Yahoo! Group that DOESN'T allow sending attachments, but there are some out
there (not this one!) that still do...!
- jim
-----Original Message-----
From: Dave Reynolds
Sent: July 24, 2001 3:00 PM
To: Pacific Distribution
Subject: Virus Alert
I have just been notified by our Anti Virus Software manufacturer (Mcafee)
of a "High Risk" virus alert.
The virus name is W32/SirCam@M... <mailto:W32/SirCam@M...> The following
information has been copied directly from the Mcafee Software website and
the virus alert memo that they have sent out:
This mass-mailing virus attempts to send itself and local documents to all
users found in the Windows Address Book and email addresses found in
temporary Internet cached files (web browser cache).
It may be received in an email message containing the following
information:
Subject: [filename (random)]
Body: Hi! How are you?
I send you this file in order to have your advice or I hope you can help me
with this file that I send or I hope you like the file that I sendo you or
This is the file with the information that you ask for See you later.
Thanks --- the same message may be received in Spanish ---
Hola como estas ?
Te mando este archivo para que me des tu punto de vista or Espero me puedas
ayudar con el archivo que te mando or Espero te guste este archivo que te
mando or Este es el archivo con la informacion que me pediste Nos vemos
pronto, gracias.
--- end message ---
Attached will be a document with a double extension (the filename varies).
The first extension will be the file type which was prepended by the virus.
When run, the document will be saved to the C:\RECYCLED folder and then
opened while the virus copies itself to C:\RECYCLED\SirC32.exe folder to
conceal its presence and creates the following registry key value to load
itself whenever .EXE files are executed:
Once again I can't stress it enough. Do not open attachments that come to
you with an e-mail from anyone. Most of these viruses are sent to people by
people they know, because they are in their address book. If you receive
e-mail with attachments and are not expecting something specific. DELETE
IT!!!!
* DR
|