Re: Another new worm???

[jlegate () ALIENCHICK COM (Jason Legate)]

It would appear that this worm was borne from the discussions on bugtraq a
while back.  Just about a month ago, an email was sent regarding this
exact issue.  I think someone ran with it, and released it in the wild, as
my company was hit by it as well.  From preliminary looks, it seems like
it plays with the filesystem, peeks/pokes at the registry, and logs on to
irc.  Has anyone else seen this?

-j

On Mon, Jun 19, 2000 at 09:49:54AM -0400, Studio1057 () AOL COM wrote:
> Hello all,
>
> This morning I am getting a lot of mail with attachments. Trends are:
> No from and to appears in the header
> Attachments have .SHS extension (??!!)
> the subject is either :Jokes", or "Funny: Jokes text", or "Life stages".
> Funny text does not show the attachment. The rest are .txt.shs extensions,
> the filename is the subject line but in all caps.
> Any ideas? I am planning to clip a copy of all the "variations" I'm getting
> to check out what is going on. Unless of course somebody else has already
> done so in which case I am anxiously awaiting what you guys cme up with.
>
> Thanks,
>
> LK

-- 
/--------------------------/ Jason Legate \------------------------\
|     jlegate () sitesmith com       |         SiteSmith, Inc.        |
|        24x7 Call Center         |    http://www.sitesmith.com    |
|          888.898.7667           |     PGP Key ID - 0xA855AAC3    |
+---------------------------------+--------------------------------+
| Fingerprint - 2D5F 87A0 26E6 A65B 6837  D100 FB54 A972 A855 AAC3 |
\------------------------------------------------------------------/


<HR NOSHADE>
<UL>
<LI>application/pgp-signature attachment: stored
</UL>