-----BEGIN PGP SIGNED MESSAGE----- On Tue, 4 Dec 2001, Joao Gouveia wrote: > I've been receiving a large quantity of a SirCam lookalike worm. Looks > like a new version of it. It's the "Goner" worm. The little beastie just hit the wires today, it seems. I collected a copy of the payload (gone.scr) for analysis here: http://www.treachery.net/~jdyson/trojans/ FYI: If you're not running Windows and you're not using MS Outlook, you don't have much to fret. This is just another Visual Basic beast that's having a laugh-riot with Yet Another Microsoft Security Issue (YAMSI). ;) - -Jay ( ( _______ )) )) .-"There's always time for a good cup of coffee"-. >====<--. C|~~|C|~~| (>----- Jay D. Dyson -- jdysonat_private -----<) | = |-' `--' `--' `---------- Si vis pacem, para bellum. ----------' `------' -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: See http://www.treachery.net/~jdyson/ for current keys. iQCVAwUBPA0tEblDRyqRQ2a9AQF3VQQAg2MEtqkV7nXS5RbI0z2esyMWUg60RFqS zxToZiGEspaPLDXE4L7bVEPwCg25PuDMiSIeBbKgWvxUci3rOLIwwfWNDjRlwD1a THK685GKjlClU7XhmU+ZCoF+7kyNovQop71GRHt69PzpI7HW7OzeoUeiDxqoDaRN 8UgV4fXuovI= =0RaN -----END PGP SIGNATURE----- ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Tue Dec 04 2001 - 13:31:25 PST