[Imc] New virus - beware

[David Young]

FYI:

This virus sent me a friend's resume yesterday. Apparently the virus scans
your files for keywords, and mails files carrying those keywords to folks
in your e-mail address list. Perhaps "resume" is one of the keywords. The
file I received had extension .doc.pif; .pif's are executable. Because
Microsoft file formats are utterly mysterious to me, I gleefully clicked
on the .pif, thinking that it was a self-extracting compressed Word file
or something. I probably infected the computer I was using. Thankfully,
my Windows e-mail address list is empty.

Dave

On Tue, Jul 24, 2001 at 10:13:50AM -0500, Kranich, Kimberlie wrote:
> Beware, friends, of a new computer virus that could strike you at home.
> It's legit. says my computer administrators at work. See email exchange
> below.
> 
> Kim
> 
> -----Original Message-----
> From: O'Dear, Laurie 
> Sent: Tuesday, July 24, 2001 9:45 AM
> To: Kranich, Kimberlie
> Subject: RE: Virus
> 
> 
> Hi Kimberlie -
> 
> I didn't see this, but yes, this is a real virus.  The virus program on the
> mail server has already caught this one several times.  People at WILL don't
> have to worry here at work - the mail server catches all email viruses.  But
> anyone with a home computer should make sure their virus scan software is
> the latest version.
> 
> Laurie
> 
> > -----Original Message-----
> > From: Kranich, Kimberlie 
> > Sent: Tuesday, July 24, 2001 9:23 AM
> > To: Mirzaei, Farzo; O'Dear, Laurie
> > Subject: Virus
> > 
> > 
> > Did you see this?  Is it something others should know about?  
> > Is it legit?
> > 
> > kak
> > 
> > -----Original Message-----
> > From: MichaelP [mailto:papadop at PEAK.ORG]
> > Sent: Tuesday, July 24, 2001 9:00 AM
> > To: cag at PEAK.ORG; ykboo at PEAK.ORG; grc at PEAK.ORG
> > Subject: [grc] listcop message
> > 
> > 
> > 
> > There a worm going round	
> > 
> > See
> > http://www.sarc.com/avcenter/venc/data/w32.sircam.worm@mm.html
> > 
> > ===========
> > 
> > The sophisticated SirCam is a strain of the Love Bug and Anna 
> > Kournikova
> > worms which caused havoc for businesses earlier this year.
> > 
> > 
> > SirCam randomly selects files from a computer's hard drive 
> > and emails them
> > to everyone in the machine's address book.
> > 
> > The email asks the recipient to give their advice on the 
> > attached document
> > and the virus spreads when this is opened.
> > 
> > 
> > It comes as an attachment with an e-mail but it's clever, not 
> > only does
> > it scoop up confidential documents on your computer it sends them to
> > everybody in your address book.
> > 
> > SirCam was first spotted last week and is more difficult to contain
> > because it changes the message in the email subject line every time it
> > attacks a new computer - using the name of the file taken 
> > from the hard
> > disk.
> > 
> > Experts are warning all users to double-check any email they 
> > receive, even
> > if it comes from a usually reliable source.
> > The message  ...
> > First line: Hi! How are you?
> > Second line: a choice of things like -I send you this file in order to
> > have your advice 
> > Last line: See you later. Thanks
> > ... comes in spanish or english
> > 
> > But, as usual, this worm attacks only Windoze systems
> > like * Windows 95/98 * Windows NT/2000 
> > 
> > 
> > 
> > 
> > 
> > ###############################################
> > 
> > This  majordomo list has been formed to continue discussion
> > generated at  the Madison GRC-5 and the Boulder GRC-6
> > conferences.  Subscribers to  <grc at peak.org> may  choose to
> > receive a digest format where several posts are bundled
> > together in a single email .
> > 
> > Initial consensus is that news items do NOT belong in the grc 
> > list unless
> > they
> > relate to the GRC mission.
> > 
> > Those seeking subscribe/unsubscribe -and other information 
> > may post the
> > message  --   intro grc  --to  <majordomo at peak.org>.
> > 
> 
> _______________________________________________
> Imc mailing list
> Imc at urbana.indymedia.org
> http://lists.groogroo.com/cgi-bin/listinfo/imc

-- 
David Young                   On the Job Consulting
dyoung at onthejob.net     Urbana, IL * (217) 278-3933