Security Incidents mailing list archives
Re: New version of SirCam?
From: "Jay D. Dyson" <jdyson () treachery net>
Date: Tue, 4 Dec 2001 13:07:42 -0800 (PST)
-----BEGIN PGP SIGNED MESSAGE----- On Tue, 4 Dec 2001, Joao Gouveia wrote:
I've been receiving a large quantity of a SirCam lookalike worm. Looks like a new version of it.
It's the "Goner" worm. The little beastie just hit the wires today, it seems. I collected a copy of the payload (gone.scr) for analysis here: http://www.treachery.net/~jdyson/trojans/ FYI: If you're not running Windows and you're not using MS Outlook, you don't have much to fret. This is just another Visual Basic beast that's having a laugh-riot with Yet Another Microsoft Security Issue (YAMSI). ;) - -Jay ( ( _______ )) )) .-"There's always time for a good cup of coffee"-. >====<--. C|~~|C|~~| (>----- Jay D. Dyson -- jdyson () treachery net -----<) | = |-' `--' `--' `---------- Si vis pacem, para bellum. ----------' `------' -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: See http://www.treachery.net/~jdyson/ for current keys. iQCVAwUBPA0tEblDRyqRQ2a9AQF3VQQAg2MEtqkV7nXS5RbI0z2esyMWUg60RFqS zxToZiGEspaPLDXE4L7bVEPwCg25PuDMiSIeBbKgWvxUci3rOLIwwfWNDjRlwD1a THK685GKjlClU7XhmU+ZCoF+7kyNovQop71GRHt69PzpI7HW7OzeoUeiDxqoDaRN 8UgV4fXuovI= =0RaN -----END PGP SIGNATURE----- ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
Current thread:
- New version of SirCam? Joao Gouveia (Dec 04)
- Re: New version of SirCam? Jay D. Dyson (Dec 04)
- Re: New version of SirCam ===w32Goner Seth Leone (Dec 04)
- <Possible follow-ups>
- RE: New version of SirCam? hpierce (Dec 04)