[Merged] The worst worm virus I've ever seen

[wly]

I think webmasters are hardest hit in the sense that we get so much of these junk mail that needs to be deleted each day. It is really such a pain. The problem is our addresses are stored in the cache of surfers so is there any way we can stop receiving this mails? or do we have to wait until our senders finds out about the virus in their computers otherwise for God's sake we shall be receiving these tons of mail each day. unless it is October what date is it? when all the users files are deleted hehehe

[AhmedF]

Slashdot had two links to Wired and CNET [i believe] that fully explained the virus.

If the virus comes in as a .link or .bat file, it basically stops itself. It varies between 5 different extensions, and the two beforementioned ones stop itself cold.

[Jan]

Ahmed do you happen to have one of those links handy so I can pass it on?

[singloon]

http://www.sophos.com/virusinfo/anal...32sircama.html

http://www.sarc.com/avcenter/venc/da...m.worm@mm.html

http://vil.mcafee.com/dispVirus.asp?virus_k=99141&

[Knut]

I'm getting hit hard by this virus. Right now I'm getting these emails every 5th minute or so! (A couple of hours ago I had to download 25 megabytes of these things... I'll have to start filtering these things serverside now - which means I'll have to learn something new :-)

First virus to ever bother me seriously this one... (Although that "Snow White" thing was annoying for a while, too :-)

I just sent out a "virus warning" to about 100 000 of my subscribers. (I don't know yet if it was a smart thing to do.
I'll probably get lots of questions I can't answer :-)

I regard that virus warning of mine an experiment in "viral marketing" ;-)

[AhmedF]

Here we go ...

What it is .... [Wired]

http://news.cnet.com/news/0-1003-200-6647394.html

http://news.cnet.com/news/0-1003-200...html?tag=tp_pr


Site Interest: KILL THEM ALL

Slashdot also has a poll going on

[jemma]

I first received this virus in e-mail from Mexico, with a plain DOC attachment labeled "Bank Accounts". I thought it probably contained a macro virus, if for no other reason then no one would ask me for advice about Mexican bank accounts.

I was tempted to download it as a TXT file and take a look. I've done that before (since my Hard Drive was destroyed by a virus a couple of years ago), and usually find some text messages from the one who wrote the virus, and the name of the virus. One guy put in a URL for specialized commercial software that he claimed would remove his virus.

Since the intial DOC attachments, I've been receiving many different e-mails with every kind of file name (e.g. froggy story, birthday party, my love) and file extension - along with the executable code attached (LNK, PIF, BAT, EXE).

Part of the Wired article (thanks for the link, AhmedF) addresses this directly, and I'll post it here, because other people might find it helpful, too.

<< The "SirC32.exe" file is registered as [the] default startup command for executable (.exe) files so it will run whenever any EXE file is run....The worm then creates a list of e-mail addresses from the Windows Address Book and Temporary Internet Files, and creates a file called "scw1.dll" in the system directory.

From the contents of the "My Documents" folder the worm makes a list of files with specific extensions including .doc, .zip and .jpg, selects a random file from the list, and attaches it to an e-mail along with a copy of the virus...

Another version of the worm has been sending the attachments as two separate files, with both the document and the code attachment infected.

A few recipients of SirCam report that the attached documents they received are not infected. "It appears that my antiviral program has stripped the virus code but is forwarding the documents to me," said Andy Antipass, a systems technician at a British security firm. "I've received pictures of people's children and vacation snapshots, two resumes, one project outline and some random word documents this morning." ...>>

I know there are reports about this all over the Net, but I haven't heard much about this on mainstream media yet (e.g. TV, newspapers). I'm not sure I undertand that - if it's causing a problem for webmasters here, it must be causing a bandwidth bottleneck on large business and commercial sites. Any news about this virus where you live?

Thanks to everyone for the links and info,

Jemma

[Shining Star Sites]

It has made the main BBC six o'clock news over here. They ran a story on it and told viewers not to open any e-mails they are unsure of who sent them and to download a virus scanner. Hopefully this may make people more alert.

[suresk]

Just got back from a mini/1 day vaction with the family (today is a state holiday in Utah). I had my phone with me, which has the wireless Internet on it, and I have it setup to work with my email. I checked it when I had a minute this morning (and we were back in a digital area ) - I groaned when I saw I had dozens of emails with big attachments

Seems like this thing is only getting worse, when I got home and turned on my computer, it took me 5 minutes to download all my email on a 640k DSL connection. It is coming from the same few people, just the file sizes seem to get bigger and bigger over time. I need to figure out how to block senders before I download the email.

[Lil_Red]

I've received nearly 300 copies today

[singloon]

are people here notifying their site's members/visitors about how to remove this virus and check if they have the virus ?

[PWR_Paul_Banker]

Does anyone know of a filtering software that will scan your email on the server before your email client downloads it, so you can delete the *(@@^^ &()@ thing before it gets to you so it doesnt lagg your email download?

[singloon]

steve on page 3 of this thread posted a link to mailsentry http://www.zdnet.com/downloads/stori...,79544,00.html

if you use whm/cpanel on your web server you can use neomail web mail module to view and delete the viruses before your download the email to your pc

or just install a web email script on your server like neomail - http://neomail.sourceforge.net/

[AhmedF]

Hehe ... i meant Side News, not Site News ;-0

You could also telnet into the server and essentially delete all emails from massively duplicagted emails.

I had a certain raiken@home.com send me 30 emails in a day. Or something like that ... sheesh.

[gallery]

Hello,

I know there is another active thread about this in webmasters issues but I would like to share my very bad experience with you in this forum as it will soon hurt my business (and your business).

Yesterday I had to download 70 MB of emails !!!!
I have a dialup connection and it took me 4 hours to empty my mailbox.
Hopefully my mailbox is huge but it is limited.
The situation gets worse everyday : I have reveived 30 MB of mails during the last 5 hours !!

I'm able now to go on the server and delete unwanted emails before they are downloaded but it takes time (I must check every 4 hours)

The only solution is to email all people that are sending this virus to you with explanation on how to remove it.

I hope that everybody will be responsible enough (or should I say, knowledgeable enough) to do it (remove the virus).