>  I believe this is the "Sircam" worm.
It is indeed the SirCam worm.  I have spent quite a bit of the last few days
either deleting them or reading about them.

  At 1.6MB, the three copies
>I've received to date (all from anonymous machines on the @home cable
>network) amount to a Denial-of-Service attack against my poor 56K
>modem!
Mine have come in various sized, all about 200-400kB.  There seem to be
different versions.
>
>  The "From:" address is clearly faked, but it does seem to be
>consistent.  If you can have that address blocked at your ISP, you
>won't see these (and won't even download them).
I have gotten about 20, from various addresses.  I'm not sure that they're
faked in the sense of not existing.  I think that the worm may be harvesting
them, perhaps from the same sources which gives it its target addresses.
>
>David Gillett
>
>On 23 Jul 2001, at 23:04, Ultra wrote:
>
>>  just delete and remember block sender!
Since the senders are inconsistent, and only the text content is pretty
constant, I would have to set up a filter based on the body.  Quite possible
in Pegasus, but the author warns you that it makes mail-handling very slow.

Thank you.
David Jonathan Justman.

             Do you want to signoff PCSOFT or just change to
                    Digest mode - visit our web site:
                   http://freepctech.com/pcsoft.shtml