[WEB4LIB] RE: SirCam Virus

[Dobbs, Aaron]

 Meaning: it's more than just another outlook virus.
-Aaron
:-)'
Oct 16th is apparently the deadline to fix this according to Andrew's link
below.

-----Original Message-----
From: Andrew Mutch
To: Multiple recipients of list
Sent: 7/25/01 8:56 AM
Subject: [WEB4LIB] RE: SirCam Virus

Nancy,

>From the Datafellows site:

"The worm uses Windows Address Book to collect e-mail addresses ('*.wab
files). The worm also tries to look for e-mail addresses in \Temporary
Internet Files\ folder ('sho*', 'get*', 'hot*', '*.html'). If a user has
a working e-mail account the worm reads the its setting. Otherwise the
'[username]@prodigy.mx.net' is
used as the default sender's address and 'prodigy.net.mx' is used for
the SMTP server name. The worm has its own SMTP engine and it sends out
messages using this engine. "

The entire description is here:

http://www.datafellows.com/v-descs/sircam.shtml

Andrew Mutch
Library Systems Technician
Waterford Township Public Library
Waterford, MI

Nancy C M Ross wrote:

> Does anyone know whether or not sircam works only with Microsoft
Outlook?  Our network administrators seem to think it is another Outlook
virus but I didn't see anything on the Symantec or McAfee sites that
said that.  We've been getting quite a few mailings on our web at lib list.
Everyone here on NT uses Eudora.
> Nancy
>
> *********** REPLY SEPARATOR  ***********
>
> On 7/25/01 at 5:52 AM Drew, Bill wrote:
>
> >Our computer people have blocked it with virus software running on
our
> >Exchange server.  It changes the attachment to an empty text file and
then
> >sends the message on to the recipient.
> >
> >Bill Drew
> >drewwe at morrisville.edu
>
>
------------------------------------------------------------------------
----
> Nancy C. M. Ross
> Digital Library Development Center
> The University of Chicago Library
> (773) 702-9481
> nross at uchicago.edu