[Esa-l]Sicam worm

[Juan Manuel Calvo]

I'm getting hundreds of emails from this virus.

Main features:

  1) Random subject selected from real subject extracted some
    real email in the sender machine.

  2) this text 
> Content-Type: text/plain; charset=ISO-8859-1
> Content-Transfer-Encoding: quoted-printable
> Content-Disposition: message text
>
> Hola como estas =3F
>
> Te mando este archivo para que me des tu punto de vista
>
> Nos vemos pronto=2C gracias=2E
>
   Others messages have the same text in English


  3) an attachment with a random name selected from a real file name
in the sender machine and a executable extension appended


No problem for my users, the double-extension trapper catch this
and DEFANGS the filename, but it is filling my disks.

Somebody knows how delete this messages? 


-- 
Ing. Juan Manuel Calvo                       |TE: +54-11-4314-2269
Director del Centro de Computos              |FAX:+54-11-4314-1654
Universidad Del CEMA                         | 
Cordoba 374 (1054) Capital Federal, Argentina| http://www.cema.edu.ar