Vulnerability Development mailing list archives

RE: Win32.Sircam.Worm Alert.....


From: "Tom Geldner" <tom () xor cc>
Date: Tue, 24 Jul 2001 09:34:35 -0700



-----Original Message-----
From: Johnson, Greg [mailto:JohnsonG () missouri edu] 

Don't let the e-mail tip-off fool you.

In our University environment we find this and related worms 
spread primarily via unprotected writeable Windows shares.  It 
also gets in when a user without up-to-date anti-virus 
software accesses an e-mail server other than our own which 
has an anti-virus filter. Bim-ba-boom!

Some of our corporate accounts have been pounded on by a particular user
on verizon.net. None of those e-mail addresses are from someone's
address book. They are all things like info@, webmaster@, postmaster@
etc. so in our case, someone seems to be trying to propogate it
deliberately.

Tom


Current thread: