[gardeners] ADMIN: infection on the loose

George Shirley (gardeners@globalgarden.com)
Tue, 24 Jul 2001 15:51:11 -0500

I borrowed this from Barb Dorsett, the Gardens listowner, and a member of this list, because I felt
everyone should be aware of it. This worm has attempted to promulgate itself through the Gardeners
list server many times but has always been caught and disabled. Be on the lookout.  


 Standard advice:
      If you get an attachment as part of your email,
      don't open it without checking it out thoroughly.
      Even then, be suspicious...some infections might
      reach your computer *before* the McAfees and SARCs
      have a chance to become aware of them.
        ...standard advice.
  Additional suggestion from Tech TV last night...
      If an email tells you (in very *general* terms)
      to open the attachment, there's a good chance
      the attachment is a virus/worm/trojan.)

New Infection Alert:

    This infection is too large to evade Gardens
    filters, but you might see examples from other
    sources...please practice safe computing.

There is an active worm on the loose right now.  Sircam is clogging up
webways, appends a random document from the infected PC to itself and sends
this new file via email.  Document selection is random...but there is the
chance that confidential information will be included.  (I got a three meg
file this morning.  Yep.  SirCam.)

The English version always starts with the words:
   "Hi! How are you?"

Then, *one* of the next four lines:
  I send you this file in order to have your advice
  I hope you can help me with this file that I send
  I hope you like the file that I sendo you
  This is the file with the information that you ask for

The last line is:  "See you later. Thanks"

On October 16th, it will delete all files on the C: drive for approximately
five percent of infected computers.


Barb Dorsett  dorsettm@scin.quik.com
active co-listowner for Gardens  mailto:gardens-request@lsv.uky.edu