On Mon, 27 Aug 2001, DREW DIAZ wrote:

> Anyone else getting files from these people?
> or is this some worm attack?

If what you're getting is email substantially as follows (with a big
attachment):


> Hi! How are you?
>
> I send you this file in order to have your advice
>
> See you later. Thanks


....That means the sender's machine has been infected with the SirCam
worm/virus.

SirCam has its own built-in mail software and so is not dependent on the
victim's email package.  It quietly originates mail when the victim's
computer is infected to the Internet, leaving nothing in any "sent items"
or "outbox" accessible to the victim.  For each email, it selects a random
file from the victim's hard drive (the email subject line is the filename)
and mails it to email addresses it finds in any one of various places,
including the browser cache.

On some date, I think in mid-October, it "attacks" and deletes files from
your hard drive.  Of course, disseminating private files is also a kind of
attack.

I have gotten well over a hundred such emails, from July 18 through today.
(Because I have a popular web site, my email address appears in a lot of
people's browser caches.)

From all indications, this infection will be with us for a long time.

Official info:
[log in to unmask]" target="_blank">http:[log in to unmask]

                                       Larry

---
Lawrence Kestenbaum, [log in to unmask]
Washtenaw County Commissioner, 4th District
The Political Graveyard, http://politicalgraveyard.com
Mailing address: P.O. Box 2563, Ann Arbor MI 48106