[WEB4LIB] RE: SirCam Virus

[Andrew Mutch]

Nancy,

>From the Datafellows site:

"The worm uses Windows Address Book to collect e-mail addresses ('*.wab files). The worm also tries to look for e-mail addresses in \Temporary Internet Files\ folder ('sho*', 'get*', 'hot*', '*.html'). If a user has a working e-mail account the worm reads the its setting. Otherwise the '[username]@prodigy.mx.net' is
used as the default sender's address and 'prodigy.net.mx' is used for the SMTP server name. The worm has its own SMTP engine and it sends out messages using this engine. "

The entire description is here:

http://www.datafellows.com/v-descs/sircam.shtml

Andrew Mutch
Library Systems Technician
Waterford Township Public Library
Waterford, MI

Nancy C M Ross wrote:

> Does anyone know whether or not sircam works only with Microsoft Outlook?  Our network administrators seem to think it is another Outlook virus but I didn't see anything on the Symantec or McAfee sites that said that.  We've been getting quite a few mailings on our web at lib list.  Everyone here on NT uses Eudora.
> Nancy
>
> *********** REPLY SEPARATOR  ***********
>
> On 7/25/01 at 5:52 AM Drew, Bill wrote:
>
> >Our computer people have blocked it with virus software running on our
> >Exchange server.  It changes the attachment to an empty text file and then
> >sends the message on to the recipient.
> >
> >Bill Drew
> >drewwe at morrisville.edu
>
> ----------------------------------------------------------------------------
> Nancy C. M. Ross
> Digital Library Development Center
> The University of Chicago Library
> (773) 702-9481
> nross at uchicago.edu