Hmm... just an idea, you could write a filter launched from procmail for example or even something on your email gateway for more exposure. This filter could automatically extract the document and info about the sender, pass through some conversion utility (eg strings for basic results) and email a "Thanks for the document" message back or worse, automatically put it up on a public website sorted by sender email address <evil grin>. I suppose that would just be asking to be sued though. Could be lots of fun stuff to collect for your home intranet though.
On Fri, 28 Sep 2001, Rick Moen wrote: > begin Erik de Castro Lopo quotation: > > > Yep, thats the SirCam virus. > > Which can be the source of endless amusement. > > Each SirCam attachment purports to be some sort of MS-Word document, > Excel spreadsheet file, or such, which were in fact lifted from the poor > sucker's hard drive and bodily included -- prefaced by (it turns out) > 137215 bytes of Win32 binary worm code, created in Borland Delphi. > > But, even though gobs of potentially juicy private documents are getting > spewed across the Internet by MS-Windows users -- including reportedly > some from sundry governments -- most of us have been simply discarding > them as spam-equivalents. Which, I submit to you, gentle readers, is a > waste! > > Just about any binary editor will do, but I recommend John H. Swaby's > very useful "fb" viewer/editor for binaries, available in x86 Linux or > Win32 binaries, or GPLed source code that'll compile just about > anywhere: http://home.mho.net/jswaby/fb.html > > To separate the attachment into its binary-payload (worm) and document > portions, use fb like this: > > fb c 0.137215 attachment sircam.worm > fb c 137216 attachment document > > Or, you can also use dd like so: > > dd if=attachment of=sircam.doc bs=512 skip=268 > > (Or you can use emacs's "hexl" mode, or bvi, or....) > -- ---<GRiP>--- Web: www.arcadia.au.com/gripz Phone/fax: 02 4950 1194 Mobile: 0408 686 201 -- SLUG - Sydney Linux User Group Mailing List - http://slug.org.au/ More Info: http://lists.slug.org.au/listinfo/slug
