> I believe this is the "Sircam" worm.
It is indeed the SirCam worm. I have spent quite a bit of the last few days
either deleting them or reading about them.
At 1.6MB, the three copies
>I've received to date (all from anonymous machines on the @home cable
>network) amount to a Denial-of-Service attack against my poor 56K
>modem!
Mine have come in various sized, all about 200-400kB. There seem to be
different versions.
>
> The "From:" address is clearly faked, but it does seem to be
>consistent. If you can have that address blocked at your ISP, you
>won't see these (and won't even download them).
I have gotten about 20, from various addresses. I'm not sure that they're
faked in the sense of not existing. I think that the worm may be harvesting
them, perhaps from the same sources which gives it its target addresses.
>
>David Gillett
>
>On 23 Jul 2001, at 23:04, Ultra wrote:
>
>> just delete and remember block sender!
Since the senders are inconsistent, and only the text content is pretty
constant, I would have to set up a filter based on the body. Quite possible
in Pegasus, but the author warns you that it makes mail-handling very slow.
Thank you.
David Jonathan Justman.
Do you want to signoff PCSOFT or just change to
Digest mode - visit our web site:
http://freepctech.com/pcsoft.shtml
|