Targetted virus infection attempt?

[Garo]

If you got an email with subject New Area Codes of the Republic of Armenia do not open the attached so called document.

 

Recently someone sends email with similar subject line and armenian name as the sender's name to armenian email addresses. At least I know 2 people who got this kind of email. Email contains some BS greetings and asking for an advice about attached document. The attached file has .doc.com extention and it's a pretty old trick to make it look like a Microsoft Word file on the computers where the Windows hides the file extention for known file types (Windows comes with this configuration by default). Actually the file is a program that will run as soon as you click on it. I scanned it with antivirus but the program couldn detect anything wrong. Still it doesn't mean the file is safe.

If you'll get this kind of email just forward it to garik@armenians.com. probably we'll be able to trace the wannabe hacker down.

[ThornyRose]

Yay, whoooooooo! ((((:

[Garo]

Latest News:

 

W32/SirCam@MM Help Center

 

DESCRIPTION - What virus is this?

 

This is a HIGH RISK virus for consumers that is spread to email recipients found in the Windows Address Book and addresses found in cached files. The infected email can come from addresses that you recognize. Attached is a file with two different extensions. The file name itself varies.

The email message can appear as follows:

Subject: [filename (random)]

Body: Hi! How are you?

I send you this file in order to have your advice

or I hope you can help me with this file that I send

or I hope you like the file that I sendo you

or This is the file with the information that you ask for

See you later. Thanks

--- the same message may be received in Spanish ---

 

Hola como estas ?

Te mando este archivo para que me des tu punto de vista

or Espero me puedas ayudar con el archivo que te mando

or Espero te guste este archivo que te mando

or Este es el archivo con la información que me pediste

Nos vemos pronto, gracias.

 

PAYLOAD - What can this virus do?

 

When run, the document will be saved to the C:RECYCLED folder and then opened while the virus copies itself to C:RECYCLEDSirC32.exe folder to conceal its presence and creates a registry key value to load itself whenever .EXE files are executed.

The virus searches for .GIF, .JPG, .JPEG, .MPEG, .MOV, .MPG, .PDF, .PNG, .PS, and .ZIP files in the MY DOCUMENTS folder and attempts to send copies of these documents to email recipients found in the Windows Address Book and addresses found in cached files.

 

more info ...

[bellthecat]

I got one as well, a couple of dats ago, with the message "I hope you can help me with this file that I sent" I sent it to delete, without even thinking. NEVER open an e-mail attachment unless the sender describes in detail what it contains, and even then it is best to contact the sender to confirm the contents.

 

Steve

 

PS the attached file was named FI.xls.com and was 274k in size.

[MosJan]

one ?? i have 129 of this in 3 days .

 

thanks to GAro i did not get a chans to opan one.

GAro jan kenats@t !!!

 

menak hima es virus scen@ kyanqs utuma , mi glux ashxatum u ashxatuma. inch a man galis chem haskanum , chto eto virus scener xochit at minya niponimayu to, vsyo krutsitsa krutsitsa... Valiko jan

 

 

Movses

[Garo]

according to McAfee's virus information library

Aside from e-mail overloading, it might delete files on 16 October and/or fill up harddisk space by adding text entries over & over again to a sircam recycle bin file.

[Paul bunyan]

has any of creeps/cruds hackers ever

been caught? what kind of punishments do they receive? if one of these creeps is in the pay of the turks,

TO THE BASTINADOES!

[Harut]

a tvoya golova ne krujitsa?