RE: strange .lnk file in email.

From: Richard Stanway (incidentsat_private)
Date: Wed Aug 22 2001 - 10:50:47 PDT

Next message: Stuart Staniford: "Re: Flash Worms"

Previous message: Graham Bignell: "RE: 24 hour strobes from 10.0.x.x"
In reply to: J. J. Horner: "strange .lnk file in email."
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

> I ran strings on the .lnk file and got a lot of stuff.  I posted
> it on the web, if anyone is interested.  I didn't want to take
> up a lot of list space to post it.
>

What you're looking at is (I think) Sircam, yet another worm that uses
Outlook to spread.
http://www.symantec.com/avcenter/venc/data/w32.sircam.wormat_private

Richard Stanway
incidentsat_private
http://www.r1ch.net/


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: Stuart Staniford: "Re: Flash Worms"
Previous message: Graham Bignell: "RE: 24 hour strobes from 10.0.x.x"
In reply to: J. J. Horner: "strange .lnk file in email."
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Wed Aug 22 2001 - 11:54:56 PDT