Re: Win32.Sircam.Worm Alert.....

["DNT" <dnt () hcm fpt vn>]

Is there anyone has Sircam's source code?
----- Original Message ----- 
From: "Chris Freels" <cfreels () gracenote com>
To: <vuln-dev () securityfocus com>; <SECURITY-BASICS () securityfocus com>
Sent: Friday, July 27, 2001 4:09 AM
Subject: RE: Win32.Sircam.Worm Alert.....


I have been seeing this virus come through my Exchange 2000 server for
the last week.  The first day I saw the alert I was receiving it.  I am
running McAfee Groupshield for Exchange 2000 SP1 and it is working just
fine.  I have not gotten one infected machine.  We are running scan
engine 4140 with the latest DAT.

Chris

-----Original Message-----
From: Kyle Plate [mailto:kyle () CLASSIFIEDTECHNOLOGIES COM]
Sent: Wednesday, July 25, 2001 3:04 PM
To: 'vuln-dev () securityfocus com'; 'SECURITY-BASICS () securityfocus com'
Subject: RE: Win32.Sircam.Worm Alert.....

FYI:

Using Symantec's NAV for Exchange (Virus def: 7/18/01 12:00am) has been
successful for us in detecting and moving to quarantine all Sircam
infected
messages that have been sent to our server.

-----Original Message-----
From: Jeremy Rodriguez [mailto:jrodriguez () intellinet-tech com]
Sent: Wednesday, July 25, 2001 9:19 AM
To: Tom Geldner; 'Johnson, Greg'; vuln-dev () securityfocus com;
SECURITY-BASICS () securityfocus com
Subject: RE: Win32.Sircam.Worm Alert.....

Yesterday the worm infected 3 of our systems. Just to test I downloaded
it,
save it a specific folder and scanned it with Norton's (using the latest
defs) and to my suprise it did not pick it up.
The fix Symantec has:
http://www.sarc.com/avcenter/FixSirc.com

Did find the worm and repair it.