Forum Archive Index - July 2001

["Murray McLean" <murray@taxreturnz.co.nz>]

Yes- received the message- it effected all my exe files and I was unable to use the computer- I have had to get a computer guy in to fix the problem-   apparently it is quite rampant at the moment.

 

DO NOT OPEN THE ATTACHMENT IF YOU GET THE MESSAGE AS DESCRIBED BY GRANT-  DELETE THE EMAIL MESSAGE IMMEDIATELY!!!!!!!!!!!!!!!!!!!!!!!!

 

 

Murray McLean
McLean and Co.
Chartered Accountants,
!33 Main Rd,
Clive
New Zealand 4152
Tel. No. (06)8700952
Fax. No. (06)8700955
Email: murray@mcleanandco.co.nz
Websites:  www.mcleanandco.co.nz and www.taxreturnz.co.nz

 

With modern technology we can asist you from afar.  Visit our website www.mcleanandco.co.nz for plenty of tax, financial and business information and download our Information Required Document to assist you in your year end Financial Statements and Tax Reurns.  Visit our website www.taxreturnz.co.nz also - this provides a database of tax and related professionals throughout New Zealand.

----- Original Message -----

From: Grant Keymer

To: sharechat@sharechat.co.nz

Sent: Wednesday, July 25, 2001 9:42 PM

Subject: [sharechat] Off Topic -- Virus Alert !!!

Is anyone else getting hit by viruses today?

In the last 24 hours I have received 5 copies of a particular virus, e-mailed to various mailboxes within our company.

 

The subject line varies but the message body is always the same:

---

Hi! How are you?
 
I send you this file in order to have your advice
 
See you later. Thanks

---

If you receive a message like this, it contains a payload called the SirCam virus held in an attachment which takes various forms appearing as an Excel Spreadsheet (.XLS) or Word Document (.DOC).

 

Actually, there is a hidden shortcut extension following this, and the file is really a Windows Executable.

If you open it, the virus will send copies of various files it finds in your "My Documents" folder.

The files will be e-mailed to everybody in your Address Book (nice).

Also, the virus looks for files cached by your Internet Browser, and examines those for e-mail addresses.

If it finds a valid e-mail address in the browser cache, the files from "My Documents" will be sent to those addresses as well.

 

This is no hoax!  Details are on McAfee's web site at:  www.mcafee.com

I have examined the code with a Hex Editor, and it has been written in Borland Delphi.

This is not the usual script-kiddie attack -- this one is much more serious.

 

It is quite hard to get rid of once your PC is infected.

So I suggest DELETING it immediately.

Whatever you do, DON'T open the attachment.

 

Cheers

Grant Keymer
____________