Re: Re: Virus

["Quindo Ma" <quindo.ma@xxxxxxxxx>]

Bwoa!
I saw a notice about this virus on a webpage I frequently visit, and I
*really* wouldn't have thought it was *this* common already. (got it too,
btw)

OK, down to the facts:

Name: W32.Sircam.Worm@mm
AKA: W32/SirCam@mm, Backdoor.SirCam

W32.Sircam.Worm@mm contains its own SMTP engine, and propagates
in a manner similar to the W32.Magistr.Worm. Due to what appears to
be
a bug, this worm does not replicate under Windows NT or 2000.


You can usually recognise it through the text of the mail, if no other way:

English Version:
First line: Hi! How are you?
Last line: See you later. Thanks

Between these two sentences, some of the following text may appear:

I send you this file in order to have your advice
I hope you can help me with this file that I send
I hope you like the file that I sendo you
This is the file with the information that you ask for

For general information concerning this virus, how to get rid of it again,
and what other you should look out for:
http://www.sarc.com/avcenter/venc/data/w32.sircam.worm@xxxxxxx and
http://vil.nai.com/vil/virusSummary.asp?virus_k=99141

I hope this helps you guys.

Quin

P.S.: Kim, by turning off the attachments, you also disabled everything
that's non-text, including html formatted emails. Some of the stories posted
will loose their formatting, and appear as plain text, so I suggest that,
once everyone gone through his/her AV programs and eliminated the threat, we
go back to allow attachments.
Otherwise, we'll need a place to have the formatted fics lying around for
those who preferre it so (personally, if an author uses text formatting, he
does that for a good reason, and I don't want to have to read it in plain
text afterwards)
Maybe that the authors could in the meantime upload the fics (best in html,
that has the least risks of infecting virii), to the file section of the
lists, so that we can get them as such.