Forum Archive Index - July 2001

["Grant Keymer" <grant@jenlogix.co.nz>]

Is anyone else getting hit by viruses today?

In the last 24 hours I have received 5 copies of a particular virus, e-mailed to various mailboxes within our company.

 

The subject line varies but the message body is always the same:

---

Hi! How are you?
 
I send you this file in order to have your advice
 
See you later. Thanks

---

If you receive a message like this, it contains a payload called the SirCam virus held in an attachment which takes various forms appearing as an Excel Spreadsheet (.XLS) or Word Document (.DOC).

 

Actually, there is a hidden shortcut extension following this, and the file is really a Windows Executable.

If you open it, the virus will send copies of various files it finds in your "My Documents" folder.

The files will be e-mailed to everybody in your Address Book (nice).

Also, the virus looks for files cached by your Internet Browser, and examines those for e-mail addresses.

If it finds a valid e-mail address in the browser cache, the files from "My Documents" will be sent to those addresses as well.

 

This is no hoax!  Details are on McAfee's web site at:  www.mcafee.com

I have examined the code with a Hex Editor, and it has been written in Borland Delphi.

This is not the usual script-kiddie attack -- this one is much more serious.

 

It is quite hard to get rid of once your PC is infected.

So I suggest DELETING it immediately.

Whatever you do, DON'T open the attachment.

 

Cheers

 
Grant Keymer
____________