Definitely a worm. Sircam to be
exact.
-----Original Message-----
From: EALES, Jack / RSAIFS - IOM [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 31, 2001 11:19 AM
To: NT System Admin Issues
Subject: Is it a bird... is it a worm??
From: EALES, Jack / RSAIFS - IOM [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 31, 2001 11:19 AM
To: NT System Admin Issues
Subject: Is it a bird... is it a worm??
One of our users has received a number of identical
messages from unrelated contacts that he (and I) is rather disturbed by... it
looks like some sort of worm / buffer overflow - maybe? I'm no expert... but I
sure there might be one or two of you out there ;-)
The attachment (which isn't attached) name
changes from message to message, but the bulk of the text of the message is the
same and is as follows:
<snip>
------1E6A12EB_Outlook_Express_message_boundary
Content-Type: text/plain;
charset=ISO-8859-1
Content-Transfer-Encoding:
quoted-printable
Content-Disposition: message
text
Hi! How are you=3F
I send you this file in order to have your
advice
See you later=2E Thanks
------1E6A12EB_Outlook_Express_message_boundary
</snip>
There
then follows a stream of several hundred / thousand (no time to
count - trust me it's lots!!) lines with seemingly random characters .
I've
hacked all this out as the list thinks I'm sending an
attachment and refuses to post
it. Does this mean anything /
look familiar to anyone? If you want the full text let me know and I'll
send it off-list
Jack
Jack
Eales
Senior PC / Network Project
Analyst
Tel: +44 1624
821236
Mob: +44 7624 450125
Fax: +44
1624 824405
Royal &
SunAlliance International Financial
Services
http://www.sunbelt-software.com/ntsysadmin_list_charter.htmhttp://www.sunbelt-software.com/ntsysadmin_list_charter.htm
