Re: [cobalt-users] Getting Mail Bombed!

["Scott Phillips" <scott@xxxxxxxxxx>]

Hello

I received the Sircam virus in my inbox last week. Thankfully I didn't open
the file attachment (I never open suspicious attachments from unknown
sources). I am not sure if this link has been posted yet, but it also
contains information about the virus and how to remove it from your machine:

http://www.symantec.com/avcenter/venc/data/w32.sircam.worm@xxxxxxx

Regards,
Scott Phillips

----- Original Message -----
From: Phil Beynon <Infolink@xxxxxxxxxxxxxxx>
To: <cobalt-users@xxxxxxxxxxxxxxx>
Sent: Monday, July 23, 2001 6:53 AM
Subject: RE: [cobalt-users] Getting Mail Bombed!


> Hi all,
>
> Hopefully this is the definitive reason you are getting mailbombed, maybe
> I'm the only person on here on the McAfee virus warnings list - who knows,
> looks like I'm the only one who read it though - would have cross posted
it
> earlier but was having a busy weekend!
> It should be possible to dump anything that contains the body content(s)
> that this virus uses by setting up a filter for that.
> On another note, any decent mailbomb app will randomise pretty much
> anything, subject, body text, size of body, senders application and other
> key factors since they are designed to be as hard as possible to trace
back
> to source.
>
> Phil
>
> ------------------------------------------------------------
>      **VIRUS ALERT - W32/SirCam@MM (Sir Cam Virus)**
> ------------------------------------------------------------
>
> McAfee.com has seen a large and growing number of consumer
> computers infected with W32/SirCam@MM.  This is a HIGH RISK
> VIRUS FOR CONSUMERS. The infected email can come from
> addresses that you recognize. Attached is a file with two
> different extensions. The file name itself varies.
>
> The email message can appear as follows:
>
> Subject: [filename (random)]
> Body: [content varies]
>
>
> Hi! How are you?
> I send you this file in order to have your advice
> or I hope you can help me with this file that I send
> or I hope you like the file that I sendo you
> or This is the file with the information that you ask for
> See you later. Thanks
>
> --- the same message may be received in Spanish ---
>
> Hola como estas ?
> Te mando este archivo para que me des tu punto de vista
> or Espero me puedas ayudar con el archivo que te mando
> or Espero te guste este archivo que te mando
> or Este es el archivo con la información que me pediste
> Nos vemos pronto, gracias.
>
> The virus searches for .GIF, .JPG, .JPEG, .MPEG, .MOV, .MPG,
> .PDF, .PNG, .PS, and .ZIP files in the MY DOCUMENTS folder
> and attempts to send copies of these documents to email
> recipients found in the Windows Address Book and addresses
> found in cached files.
>
> For detection and removal instructions for the Sir Cam Virus,
> click here.
> -> http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=2371
>
> Retail VirusScan Users:
> Version 4.0.70 and above with DAT file 4148 will detect and
> remove this virus.  To download the latest DAT files,
> click here.
> -> http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=2253
>
> Find out more about this virus. Click here to go to the
> W32/SirCam@mm Help Center.
> -> http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=2371
>
>
> _______________________________________________
> cobalt-users mailing list
> cobalt-users@xxxxxxxxxxxxxxx
> To Subscribe or Unsubscribe, please go to:
> http://list.cobalt.com/mailman/listinfo/cobalt-users
>