Notices
ScoobyNet General General Subaru Discussion
Sponsored by:
Sponsored by:

VIRUS WARNING - SirCam32

Thread Tools
 
Search this Thread
 
Old 04 August 2001, 02:57 PM
  #1  
DrEvil
Scooby Regular
Thread Starter
 
DrEvil's Avatar
 
Join Date: Oct 2000
Location: Surrey, UK
Posts: 8,384
Likes: 0
Received 0 Likes on 0 Posts
Angry

Just to warn you, if you get an email from a David?????1982 (sorry these are the bits I remember) with an excel attachment (i know, oldest one in the book) called "Formula 1 blah blah stats" then DON'T OPEN IT.

Norton AV didn't pick it up until it was too late

Likewise the system may have emailed you this from me, hope not.

I will be rebuilding my home system due to this worm, its destroyed everything, and unfortunately I lost a lot of email addresses.

So if you have sent me something relating to any events we/i are organising, please resend .

Thanks, Alex
Old 04 August 2001, 03:13 PM
  #2  
boomer
Scooby Senior
 
boomer's Avatar
 
Join Date: Feb 2000
Location: West Midlands
Posts: 5,763
Likes: 0
Received 0 Likes on 0 Posts
Exclamation

Alex,

do you have/do Norton updates?

I was sent an infected e-mail from another Scooby-netterlast week, but it *did* pick it up (NAV 2001). In fact, so much so that i have difficulty trying to "take a look" at the offending PIF file.

See
Old 04 August 2001, 04:43 PM
  #3  
bob
Scooby Regular
 
bob's Avatar
 
Join Date: Nov 1998
Location: Bristol
Posts: 1,391
Likes: 0
Received 0 Likes on 0 Posts
Post

I have been getting SirCam32 regularly for the past few days I also get W32.Magistr and W95.Hybris(Seven Dwarfs). My Norton antivirus picks these up straight away.
DrEvil/ are you certain you are scanning the emails as they are coming in? Or are you not updating every week? When receiving mail you should get another envelope in the bottom right corner with a magnifying glass passed over it as the mail is coming in.
Old 04 August 2001, 04:45 PM
  #4  
Andy W
Scooby Regular
 
Andy W's Avatar
 
Join Date: Jul 2001
Posts: 1,887
Likes: 0
Received 0 Likes on 0 Posts
Post

I think you need to activate NAV Email protection in the options part of NAV.

Andy
Old 04 August 2001, 05:03 PM
  #5  
Richard Askew
Scooby Regular
 
Richard Askew's Avatar
 
Join Date: Dec 2000
Location: A land of lap-dancers and Lanson Black Label
Posts: 9,400
Likes: 0
Received 0 Likes on 0 Posts
Exclamation

......yep I just got it from David Reid Motorsport,Forge Motorsport and a couple of private peeps who I dont know.......the one from Forge was disguised as Samco Hose Price list...... fortunately the McCaffee on Hotmail did its thing
There are some sad wan**rs out there with nowt better to do.....b*******

Old 04 August 2001, 05:04 PM
  #7  
AndyC_772
Scooby Regular
iTrader: (2)
 
AndyC_772's Avatar
 
Join Date: Mar 2001
Location: Swilling coffee at my lab bench
Posts: 9,096
Likes: 0
Received 0 Likes on 0 Posts
Post

I received this worm (from a Subaru parts supplier, no less) and had a similar problem with Norton not picking it up straight away.

The problem was that I'd added a new mail account in Outlook Express and received it through that - you have to enable scanning of each account separately (and manually!) in Norton to make sure that you're covered.

It's worth mentioning also that the attachment can be any file from the infected sender's hard disc (and won't even have the same extension added to the end of the filename), and that the text of the message isn't always the same.

Andy.
Old 04 August 2001, 06:39 PM
  #8  
PAS
Scooby Regular
iTrader: (4)
 
PAS's Avatar
 
Join Date: Jun 2000
Posts: 695
Likes: 0
Received 0 Likes on 0 Posts
Post

We had an email from someone called HaHaHa and it's title was Seven Dwarfs. I thought I remembered hearing something about this and never opened it. Good job I didn't, I just deleted it.

Tracey
Old 04 August 2001, 06:42 PM
  #9  
DR Motorsport
BANNED
 
DR Motorsport's Avatar
 
Join Date: Feb 2001
Posts: 624
Likes: 0
Received 0 Likes on 0 Posts
Post

We had this virus sent to us last weekend from one of our main suppliers. Titled Invoice. Naturally we opened it, the virus check didn't pick it up either. So at that point it then goes through our address book re-sending itself out. So to anyone who was contacted by us, we can only appologise.
The virus now gets sent to us 2-3 times per day from all over the world, usually the States.
We have now installed the latest checks from Macafee, who also have instructions on how to get everything back to normal.
David
Old 04 August 2001, 06:44 PM
  #10  
ChrisB
Moderator
 
ChrisB's Avatar
 
Join Date: Dec 1998
Location: Staffs
Posts: 23,573
Likes: 0
Received 0 Likes on 0 Posts
Post

Old 04 August 2001, 07:03 PM
  #11  
David Lock
Scooby Regular
 
David Lock's Avatar
 
Join Date: Mar 2000
Location: Weston Super Mare, Somerset.
Posts: 14,102
Likes: 0
Received 0 Likes on 0 Posts
Question

Can a friendly bod give some advice to IT challenged of Sussex please. I have recd half a dozen dodgy attachments recently with message "I send you this for your advice please" - it was mentioned on this board recently. I do have Norton and update it but I don't know how to use it to scan an attachment before I open it. I simply delete them without opening or I supose I could put onto floppy and scan that? Final thicko question - can I get into trouble simply by opening the message itself. I am not sure how to delete without clicking on message first. Thanks in advance. David
Old 04 August 2001, 07:04 PM
  #12  
Avi
Scooby Regular
 
Avi's Avatar
 
Join Date: Apr 2001
Location: Manchester
Posts: 5,084
Likes: 0
Received 0 Likes on 0 Posts
Post

Yup.. i've recieved this from fellow scoobynetters aswell

Old 04 August 2001, 09:11 PM
  #13  
matt d
Scooby Regular
 
matt d's Avatar
 
Join Date: Mar 2001
Posts: 296
Likes: 0
Received 0 Likes on 0 Posts
Post

3 ways to protect against this type of email virus:

1) don't open attachments (if you are expecting it, email back the sender asking them to confirm the attachment if definitely not a virus)
2) use the outlook express filters to ban anything with a *.vbs or *.exe in it
3) do not keep any documents in your "my documents" folder - viruses often take files from here since, surprise surprise, that's where 99% of people keep ALL their documents (including the ones they don't want anyone else to see - doh!).
Old 04 August 2001, 09:51 PM
  #14  
joe90
Scooby Newbie
 
joe90's Avatar
 
Join Date: Jun 2001
Posts: 25
Likes: 0
Received 0 Likes on 0 Posts
Post

I suffered an outbreak of SirCam32 at work - our virus software was 1 week out of date due to a minor setup problem.

The following link gives details about the virus and how to recover a system:
Old 04 August 2001, 11:19 PM
  #15  
turbo spudgun
Scooby Regular
 
turbo spudgun's Avatar
 
Join Date: Apr 2001
Posts: 66
Likes: 0
Received 0 Likes on 0 Posts
Post

i am gonna kill someone!!

ive been offline for a whole feckin week trying to get this sircam virus off my system, to no avail! ive lost everything

if someone sends you a file saying something like..

hi mate, how are you, ive sent you this file for your opinion, what do you think?

DO NOT OPEN IT!!!!!!!!!!!

i did and it trashed my computer
this virus goes through your mailbox and forwards itself automatically..its evil!

its good to be back though! but now i'm classed as a newbie . the spudgun has returned, and now i'm turbocharged
Old 04 August 2001, 11:32 PM
  #16  
Natural Born Chiller
Scooby Regular
 
Natural Born Chiller's Avatar
 
Join Date: Feb 2001
Location: Waltham, a nice village that's just a little too close to Grimsby!
Posts: 166
Likes: 0
Received 0 Likes on 0 Posts
Post

I have also been blitzed by a multitude of viruses/worms recently, more than ever before! Got the SirCam32 worm and NAV2001 picked it out straight away!
If you don't have Norton or any other reputable antivirus software installed, you are taking a really big risk! Simply right clicking on a dodgy email with an attachment, to delete it, OPENS IT in the preview window (if enabled) and will execute certain VBscrips etc embeded within the mail! And it's got you!!!

They're out to get you! Sad B@st@rds!
Old 05 August 2001, 12:04 AM
  #17  
ScoobyDan
Scooby Regular
 
ScoobyDan's Avatar
 
Join Date: Apr 2001
Location: West Sussex
Posts: 227
Likes: 0
Received 0 Likes on 0 Posts
Lightbulb

A note about the preview pane in Outlook / Outlook Express:

As long as you have updated Outlook since the 'I Love You' virus, then Microsoft changed the software to prevent '.vbs' and '.exe' attachments from being run from the preview pane. A virus WILL NOT infect your system unless you double-click (to execute) the relevant attachment. Just viewing the e-mail WILL NOT infect your system. Trust me!

Daniel (not IT challenged)
Old 05 August 2001, 12:44 AM
  #18  
Natural Born Chiller
Scooby Regular
 
Natural Born Chiller's Avatar
 
Join Date: Feb 2001
Location: Waltham, a nice village that's just a little too close to Grimsby!
Posts: 166
Likes: 0
Received 0 Likes on 0 Posts
Post

As Daniel pointed out, there has been many security fixes for outlook/express and these are available to download from microsoft.

Open Internet Explorer and click on the 'Tools' option. Now select 'Windows Update', and this will auto detect what parts of your windows system needs to be updated. Select (Check) the items you wish to update(if it has'nt done already) and download the updates.

<B>WREXY</B> - you will have to update to at least NAV2000 for Email protection, as this feature was not built into the earlier versions of Norton.
Norton Anti Virus 2001 Costs about £40 in Electronics Boutique, and is well worth the money! You can also buy it with Norton Utilities or Personal Firewall, which again is quite excellent... Top package!
You'll probably get a better deal buying off the net if you shop around, or you could just use winmx to download it!
(Just dont tell them i told you about it! )

N.B.C.
Old 05 August 2001, 01:35 AM
  #19  
WREXY
Scooby Regular
 
WREXY's Avatar
 
Join Date: Feb 2001
Location: Greece, previously Syd Australia
Posts: 2,833
Likes: 0
Received 0 Likes on 0 Posts
Post

Hi Bob,

I think I received this too. It was weird it was sent by Sydney Paint who I don't know. It was titled A= and then hieroglyphics. It had an attachment ending in EXE. I deleted it without opening the attachment, also deleted in my deleted items.

I have Norton version 5 for windows 95/98 and had already updated the new virus definitions. However I do not have an E Mail option in options. I have to the left,(as you mention Bob), Memory, Master boot record, Boot records, Within compressed files, but no E mail option. To the right I have All files, which I have ticked and Program files. I have auto protect enabled and in the help menu it says that I'm protected from internet downloads. Is E mail covered though? I definately do not have an E mail option.

Also how do you dissable the mail being opened when you right click in the preview window as described by Natural Born Chiller. Sometimes I want to delete mail without opening it and I right click to get the menu up and it opens the letter before I can click on delete. I have outlook.

Any information would be gladly appreciated as I'm still in kindergaten when it comes to PC's.

Cheers,

WREXY.
Old 05 August 2001, 01:36 AM
  #20  
bob
Scooby Regular
 
bob's Avatar
 
Join Date: Nov 1998
Location: Bristol
Posts: 1,391
Likes: 0
Received 0 Likes on 0 Posts
Post

Spudgun/
Top o' the mornin' to you.
You have just received the "IRISH VIRUS".
Being Irish, we don't have too much programming experience, so this virus
works on the honour system.
Please manually delete all the files on your hard drive and forward this
Virus to everyone on your mailing list.
Thank you for your co-operation.
Old 05 August 2001, 02:02 AM
  #21  
bob
Scooby Regular
 
bob's Avatar
 
Join Date: Nov 1998
Location: Bristol
Posts: 1,391
Likes: 0
Received 0 Likes on 0 Posts
Post

Wrexy/
I am using Norton 2000 version 6.10.20
This version scans emails as they come in. I do not know about the version you have. When my emails come in I see an extra envelope down in the right corner with a magnifying glass going backwards and forwards. Might be worth you updating the Norton software if you cannot get the emails scanned.
I use Microsoft outlook and if I right click on the preview pane bar I can disable it. This can also be done by clicking the view bar. I never use the preview pane but double click the bottom email. When I delete that mail the next one automatically pops up.
Old 05 August 2001, 06:45 AM
  #22  
David Lock
Scooby Regular
 
David Lock's Avatar
 
Join Date: Mar 2000
Location: Weston Super Mare, Somerset.
Posts: 14,102
Likes: 0
Received 0 Likes on 0 Posts
Post

Bob, Many thanks - help much appreciated. David (IT challenged). But NOT the David in thread start-up message!!
Old 05 August 2001, 12:07 PM
  #23  
bob
Scooby Regular
 
bob's Avatar
 
Join Date: Nov 1998
Location: Bristol
Posts: 1,391
Likes: 0
Received 0 Likes on 0 Posts
Post

David/
With Norton you should have a small icon bottom right of screen.
Right click it, and left click open Norton antivirus.
Go to options top centre and click it.
To the left you will see Email protection click it.
Make certain your enable email protection is ticked.
In the box Protected email clients make certain all these are ticked

Send yourself an email and you should see the envelopes being scanned in your bottom right hand corner.
Old 05 August 2001, 12:13 PM
  #24  
turbo spudgun
Scooby Regular
 
turbo spudgun's Avatar
 
Join Date: Apr 2001
Posts: 66
Likes: 0
Received 0 Likes on 0 Posts
Talking

did u send me this bob for ditching the sti!
Old 05 August 2001, 12:50 PM
  #25  
bob
Scooby Regular
 
bob's Avatar
 
Join Date: Nov 1998
Location: Bristol
Posts: 1,391
Likes: 0
Received 0 Likes on 0 Posts
Post

If I had a contacts list with only your name in it you could blame me. At the moment I have a few thousand names in my contacts list so cannot afford to get caught myself.
I would not wish these viruses on anybody not even you Spudgun.
Have you given Chins/Jonathan his fiver yet
Old 05 August 2001, 01:41 PM
  #26  
WREXY
Scooby Regular
 
WREXY's Avatar
 
Join Date: Feb 2001
Location: Greece, previously Syd Australia
Posts: 2,833
Likes: 0
Received 0 Likes on 0 Posts
Thumbs up

Thank you to all for the top advice. I certainly will update to the newer Norton and I'm going in to the microsoft update now.

Cheers,

WREXY.
Old 05 August 2001, 02:46 PM
  #27  
Beastie
Scooby Regular
iTrader: (2)
 
Beastie's Avatar
 
Join Date: Jan 2001
Location: Scotland
Posts: 2,397
Received 17 Likes on 10 Posts
Talking

I actually got SirCam into my computer. My first virus ever!! Unfortunately I had McAfee disabled at the time as I was connecting with my mobile phone in Greece. Luckily, I think? I am using aol and so Outlook Express has never been used. Once back in semi-civilisation i.e. Norway I updated McAfee and it immediately found the SirCam. It deleted the E-mail and attachment that contained it, but which I had opened, and also deleted WindowssystemsciI.dll.
What is this file needed for and should I replace it, or is it just a file the virus made? I presume in Outlook Express?

My computer is now its usual tetchy self, I did a full system scan, so am I worrying needlessly? Any help appreciated.

Beastie

[This message has been edited by Beastie (edited 05 August 2001).]
Old 05 August 2001, 03:50 PM
  #28  
WREXY
Scooby Regular
 
WREXY's Avatar
 
Join Date: Feb 2001
Location: Greece, previously Syd Australia
Posts: 2,833
Likes: 0
Received 0 Likes on 0 Posts
Talking

Welcome aboard Beastie

Cheers,

WREXY.
Old 05 August 2001, 04:55 PM
  #29  
Beastie
Scooby Regular
iTrader: (2)
 
Beastie's Avatar
 
Join Date: Jan 2001
Location: Scotland
Posts: 2,397
Received 17 Likes on 10 Posts
Wink

Its all your fault any way WREXY.
Old 06 August 2001, 12:17 AM
  #30  
WREXY
Scooby Regular
 
WREXY's Avatar
 
Join Date: Feb 2001
Location: Greece, previously Syd Australia
Posts: 2,833
Likes: 0
Received 0 Likes on 0 Posts
Unhappy

Hi all,

Yesterday I dowloaded the new Internet Explorer 5.5 from the widows update site, as I said I would on my previous post. I now have a problem with outlook express. If I click on outlook express icon on my desktop the dial up window does not come up, instaed a window with the following comes up,

"An error occurred while establishing the Dial-Up Network connection 'ONEWAY NET'".

It was working fine before I downloaded the new version of internet explorer.

If I go to mail from my toolbar when I'm already connected to the internet it works fine. I have gone into properties but everything seems OK there. Any ideas?
Again, any information would be gladly appreciated, for a kindergarten PC user.

Cheers,

WREXY.


Quick Reply: VIRUS WARNING - SirCam32



All times are GMT +1. The time now is 11:37 AM.