Re: Win32.Sircam.Worm Alert.....

[Miguel Angel Rodriguez Jodar <rodriguj () atc us es>]

And it's curious to notice that everytime I've tried to read the worm file
using the UNIX pine program, it has always reported me an internal BASE64
error. Has this email some kind of self-executing code that might be fired
upon the opening of the affected message? This kind of behaviour seems
quite caracteristic for bad-formed mail messages that could affect
Outlook.

--
Miguel Angel Rodriguez Jodar | http://icaro.fie.us.es
Area de Arquitectura y Tecnologia de Computadores
Universidad de Sevilla


On Wed, 25 Jul 2001, Pete Sherwood wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> - - - ----- Original Message -----
> From: "EPiC" <epic () hack3r com>
> To: <vuln-dev () securityfocus com>; <SECURITY-BASICS () securityfocus com>
> Cc: "ProgramJammer" <programjammer () hack3r com>
> Sent: Monday, July 23, 2001 2:08 PM
> Subject: Win32.Sircam.Worm Alert.....
>
>
> > Friday morning I recieved an email from a friend,  it looked as though he
> > was sending me a .doc to look over. To my dismay, it was a worm that had
> > infected him.
...
...
...

> Pete Sherwood
> 613-260-0612 (home/office)
> 613-591-8900 ext. 525 (voice-mail)
> PGP and Thawte digital keys available @
> http://members.home.net/petersherwood/
>
>
> -----BEGIN PGP SIGNATURE-----
> Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com>
>
> iQA/AwUBO17bdbomytMtxLfsEQK/+gCg8pDeCcLE4O2UyqsvdVfSFZQ3vNwAn2DW
> OC3Fjl4IXnidhveCHYBD2oEQ
> =4ceh
> -----END PGP SIGNATURE-----