[Esa-l]Sicam worm

Juan Manuel Calvo jmc at cema.edu.ar
Fri Jul 20 15:27:09 PDT 2001

I'm getting hundreds of emails from this virus.

Main features:

  1) Random subject selected from real subject extracted some
    real email in the sender machine.

  2) this text 
> Content-Type: text/plain; charset=ISO-8859-1
> Content-Transfer-Encoding: quoted-printable
> Content-Disposition: message text
> Hola como estas =3F
> Te mando este archivo para que me des tu punto de vista
> Nos vemos pronto=2C gracias=2E
   Others messages have the same text in English

  3) an attachment with a random name selected from a real file name
in the sender machine and a executable extension appended

No problem for my users, the double-extension trapper catch this
and DEFANGS the filename, but it is filling my disks.

Somebody knows how delete this messages? 

Ing. Juan Manuel Calvo                       |TE: +54-11-4314-2269
Director del Centro de Computos              |FAX:+54-11-4314-1654
Universidad Del CEMA                         | 
Cordoba 374 (1054) Capital Federal, Argentina| http://www.cema.edu.ar

More information about the esd-l mailing list