Just received this and thought it couldn't hurt to share.
Janet
>>> "List Manager" <[EMAIL PROTECTED]> 07/23/01 09:37AM >>>
CENTRALCOMMAND.COM Newsletter
Without us, there's no defense.
You are receiving this newsletter because you subscribed to the
CENTRALCOMMAND.COM newsletter at http://www.centralcommand.com. This is
an open-subscription mailing list. If you do not want to receive this
newsletter please see the bottom of this message for instructions on how
to remove your e-mail address from this mailing list.
Virus Protection for the Real World.
If you suspect a virus infection you can download a free time limted,
fully functional trial version of AntiVirus eXpert antivirus
software from http://www.centralcommand.com
Visit CENTRALCOMMAND.COM online http://www.centralcommand.com
Central Command is re-releasing this URGENT virus warning due to
increased levels of infection reports from I-Worm.Sircam.A. This
virus is spreading globally at an alarming rate.
AntiVirus eXpert has been updated for this worm since early last
week. Please update AntiVirus eXpert if you have not already done
so.
I-Worm.Sircam.A
Name: I-Worm.Sircam.A
Aliases: W32.Sircam.Worm@mm, W32/SirCam@mm
Type: Internet Worm (mass mailer)
Risk: High
Description:
I-Worm.Sircam.A is an Internet worm that is spreading itself
through e-mail.
The worm arrives through e-mail in the following format:
Subject: (The subject line will be random)
Body: Hi! How are you? See you later. Thanks
Attachment: (Same as Subject: line + containing a double extension,
ie. COM.EXE)
*Note: It might be possible that it will contain additional text
in between the two lines listed above
When the user opens the attachment, the worm adds the following
keys into the registry:
HKCR\exefile\shell\open\command\Default="c:\recycled\SirC32.exe"
"%1" %*
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\Driver32
=c:\windows\system\SCam32.exe
The first registry key enables the worm to copy the SirC32.exe file
to the folder C:\Recycled\ which allows the worm to run after each
*.exe file is executed. The second key stores the filename
Scam32.exe into the C:\Windows\System folder, which allows the worm
to execute automatically.
Worm.Sircam.A also uses its own special SMTP routine to send
unsolicited email messages to those addresses obtained from a
search within the Windows address book, as well as, from the users
Temporary Internet folder.
*There is also a duplicate of this worm in the Spanish language.
The body format of the Spanish e-mail message would contain the
lines:
Hola coma estas ?
Nos vemos pronto, gracias
Central Command, Inc. respects your online privacy. You at anytime
can easily remove your e-mail address from the Central Command mailing
list by sending an e-mail message To: [EMAIL PROTECTED]
and in the body of the message include the following replacing
"[EMAIL PROTECTED]" with your e-mail address.
unsubscribe news [EMAIL PROTECTED]
You will receive a confirmation message about your successful
removal from News.
IF YOU ARE NOT ABLE TO REMOVE YOUR E-MAIL ADDRESS USING THE ABOVE
METHOD PLEASE SEND AN E-MAIL MESSAGE TO [EMAIL PROTECTED]
AND REQUEST TO BE REMOVED MANUALLY.
Central Command, PerfectSupport, EVRT, Emergency Virus Response
Team, Virus Protection for the Real World, Without us, there's
no defense. are trademarks of Central Command Inc. AntiVirus eXpert
is a trademark of Softwin SRL, Romania. All other trademarks, trade
name and product names are property of their respective owners.
Copyright (C) 2000, 2001 Central Command Inc. All rights reserved.
