This message is the carrier of the Sircam virus. Of course, without the
attachment, the virus was unable to hitchhike, so no problem. Hooray, Mark,
for his programming that strips attachments! Likely Clemens did not
purposely send it but his machine is infected [get the fix from Symantec
(www.symantec.com/avcenter/)]. Sircam sends itself to people to whom Clemens
has answered an e-mail (in this case, likely replying to a Team.Net post),
and picked up as the subject line just any old thing that happened to be on
Clemens' OE list (not necessarily the message to which he replied). That's
why the subject line is no clue to this virus, but that message "Hi! How are
you" and asking for advice IS. There are variants to that middle line in the
vein of "here is the file you requested."
--Rocky
-----Original Message-----
From: Clemens Burger <burgerc@iquest.net>
To: autox@autox.team.net <autox@autox.team.net>
Date: Monday, August 06, 2001 9:47 PM
Subject: consump1
>Hi! How are you?
>
>I send you this file in order to have your advice
>
>See you later. Thanks
>
>[demime 0.97c removed an attachment of type application/mixed which had a
name of consump1.xls.pif]
>
>[demime 0.97c removed a section which didn't have a content-type header]
>
>/// autox@autox.team.net mailing list
>///
>/// To unsubscribe send a plain text message to majordomo@autox.team.net
>/// with nothing in it but
>///
>/// unsubscribe autox
>///
/// autox@autox.team.net mailing list
///
/// To unsubscribe send a plain text message to majordomo@autox.team.net
/// with nothing in it but
///
/// unsubscribe autox
///
|