I apparently opened a computer virus at work today and probably sent two
messages to everyone on this address book.
I'm sorry. This is a very serious virus, and I do apologize.
It is called the W32/SirCam@MM virus.
removal instructions can be found online at:
http://www.mcafee.com/anti-virus/viruses/sircam/default.asp?cid=2360
Please take the proper corrective action.
Apologies,
Lenny
----
the following is from:
http://www.mcafee.com/anti-virus/viruses/sircam/default.asp?cid=2360
DESCRIPTION - What virus is this?
This is a HIGH RISK virus that is spread to email
recipients found in the
Windows Address Book and addresses found in cached
files. The infected
email can come from addresses that you recognize.
Attached is a file with
two different extensions. The file name itself
varies.
The email message can appear as follows:
Subject: [filename (random)]
Body:
Hi! How are you?
I send you this file in order to have your
advice
or I hope you can help me with this file that
I send
or I hope you like the file that I sendo you
or This is the file with the information that
you ask for
See you later. Thanks
--- the same message may be received in
Spanish ---
Hola como estas ?
Te mando este archivo para que me des tu
punto de vista
or Espero me puedas ayudar con el archivo que
te mando
or Espero te guste este archivo que te mando
or Este es el archivo con la informacisn que
me pediste
Nos vemos pronto, gracias.
PAYLOAD - What can this virus do?
When run, the document will be saved to the
C:\RECYCLED folder and
then opened while the virus copies itself to
C:\RECYCLED\SirC32.exe
folder to conceal its presence and creates a
registry key value to load
itself whenever .EXE files are executed.
The virus searches for .GIF, .JPG, .JPEG, .MPEG,
.MOV, .MPG, .PDF, .PNG,
.PS, and .ZIP files in the MY DOCUMENTS folder and
attempts to send
copies of these documents to email recipients found
in the Windows
Address Book and addresses found in cached files.
-----------
|