From: John Correia <jcorreia@biochem.umsmed.edu>
  To  : rasmb@alpha.bbri.org
  Date: Thu, 26 Jul 2001 16:59:14 -0500

Re: Fwd: SIRCAM Virus threat

My office computer was recently infected with a virus called
W32.Sircam.Worm@mm - descriptions and a fix-it file are available at 

http://www.symantec.com/avcenter/ 

I ran the fix off a zip disk (my computer was locked up so I downloaded it
elsewhere)  in dos mode but you may need windows to be up in the
background.  

It will attack the registry file and autoexec.bat files plus send mail
from your maillists with infected attachments.  Before I updated Norton
and found it my symptoms were a very slow computer response time.

I mention it because I understand it is especially attacking listservers
(The FBI even went down today) and I probably got it from someone at Utah
who belongs to the RASMB list.  I am appending a message we got earlier
today that describes the email message format to be wary of.  This is also
on the norton site.


Due to suspected infections already detected on our campus, all UMC
inbound and outbound GroupWise email services have been suspended.  Any
messages coming in or going out, should be queued up by the system for
later delivery.  DIS hopes to have these services restored early Thursday.

Please remain very vigilant, paying close attention to the message that
follows for details about what this virus looks like and how you can
protect yourself and others from the threat.

Subject: The subject of the email will be random, and will be the same as
the file name of the email attachment.
Attachment: The attachment is a file taken from the sender's computer and
will have the extension .bat, .com, .lnk or .pif added to it.
Message: The message body will be semi-random, but will always contain one
of the following two lines (either English or Spanish) as the first and
last sentences of the message.

Spanish Version:
First line: Hola como estas ?
Last line: Nos vemos pronto, gracias.

English Version:
First line: Hi! How are you?
Last line: See you later. Thanks

Between these two sentences, some of the following text may appear:

Spanish Version:
Te mando este archivo para que me des tu punto de vista
Espero me puedas ayudar con el archivo que te mando
Espero te guste este archivo que te mando
Este es el archivo con la informaci=n que me pediste

English Version:
I send you this file in order to have your advice
I hope you can help me with this file that I send
I hope you like the file that I sendo you
This is the file with the information that you ask for