Re: New version of SirCam?

["Jay D. Dyson" <jdyson () treachery net>]

-----BEGIN PGP SIGNED MESSAGE-----

On Tue, 4 Dec 2001, Joao Gouveia wrote:

> I've been receiving a large quantity of a SirCam lookalike worm.  Looks
> like a new version of it. 

        It's the "Goner" worm.  The little beastie just hit the wires
today, it seems.  I collected a copy of the payload (gone.scr) for
analysis here:

        http://www.treachery.net/~jdyson/trojans/

        FYI: If you're not running Windows and you're not using MS
Outlook, you don't have much to fret.  This is just another Visual Basic
beast that's having a laugh-riot with Yet Another Microsoft Security Issue
(YAMSI).  ;)

- -Jay

   (    (                                                        _______
   ))   ))   .-"There's always time for a good cup of coffee"-.   >====<--.
 C|~~|C|~~| (>----- Jay D. Dyson -- jdyson () treachery net -----<) |    = |-'
  `--' `--'  `---------- Si vis pacem, para bellum. ----------'  `------'

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: See http://www.treachery.net/~jdyson/ for current keys.

iQCVAwUBPA0tEblDRyqRQ2a9AQF3VQQAg2MEtqkV7nXS5RbI0z2esyMWUg60RFqS
zxToZiGEspaPLDXE4L7bVEPwCg25PuDMiSIeBbKgWvxUci3rOLIwwfWNDjRlwD1a
THK685GKjlClU7XhmU+ZCoF+7kyNovQop71GRHt69PzpI7HW7OzeoUeiDxqoDaRN
8UgV4fXuovI=
=0RaN
-----END PGP SIGNATURE-----


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com