[KLUG Members] scam32.exe, sirc32.exe or sircam.exe worm

[Richard Zimmerman]

Hello!

   I'd thought I drop you all a line to warn you that the win32/Sircam worm is
on the loose. From the information I have it was discovered on 7/17/01 and is
moving around quite rapidly.

   It struck two of my computers here this morning thanks to one mf my
customers but the firewall software installed on all of my internal machines
prevented it from spreading! Oddly enough it does *NOT* use outlook express to
spread itself, it relies on it's own internal program(s) sirc32.exe,
scam32.exe or sircam.exe.

   I have now discovered that several email support groups (qmail especially)
has also been infected.

   I thought full disclosure might be a good ides so you folks can get your
virus scanning software up to date!

   While I realize this isn't specifcally Linux related, my linux based email
scanners missed it this morning! If you are using McAfee's 4.0 virus scanner
on Linux / Windows make sure you have the 4149 or higher .dat files!

   Richard


Richard Zimmerman                                     Richard@knbpower.com
Information Systems Manager                      ke4rit@earthlink.net
K&B Transport, Inc.
Elkhart, Indiana                     Advanced SKYWARN weather spotter

Look Listen and Live!
Support Operation Lifesaver
www.oli.org