From: "lisa" <>
Subject: [TN-CEM] virus please ready!!!!!!!!!!
Date: Wed, 25 Jul 2001 17:22:56 -0400
hi all of you are infected with a virus.....it's a virus that thousands of people have and are getting, and it also brings back the snow white virus......why these people make virus' is mind boggling........anyway, I thought I would tell you how to rid of it. You are in my address book and it has attached itself to your computer via my address book, I got it the same way, I was in someone's address book and gave it to me.........Your virus will not be detected with a virus scan.......here is how I got rid of it, and have included all instructions..........you must email your entire address book and forward this message so that people can clean this out before their computer crashes. I lost all data, most collected over a 5 year period 3 weeks ago and am still devestated over it. Thanks and sorry about the virus but I don't want it comming back to me again.......... Lisa
ps there is no virus attached to this email I have gotten rid of it..........
here's what the the tech guy sent me, pretty detailed email.........
Lisa, these are the e-mails from friends who also receive the SirCam Virus. There are a few tools you can use especially the Sircam Removal tool, but you still must check your autoexec.bat. The SARC Reference seems to work best.
Lisa,
1. If you open the e-mail, it then attaches some file from your 'My Documents' and sends it to everyone in your address book and every contact that might be in your InBox (like forwards from other people). It then buries itself in your registry and hides itself and does the same thing over and over again everytime you start up an '.exe' file.
http://www.symantec.com/avcenter/venc/data/ type="text/javascript">DisplayMail('mm.removal.tool.html','w32.sircam.worm');
This is where I went to get rid of the virus, because I didn't have my viruschecker up to snuff
2. A new Windows E-Mail virus has been reported by members, arriving with the
subject line named for the attached file (which contains the virus) and a
body which usually consists of three lines. The first and last line are
usually:
Hi! How are you?
and
See you later. Thanks
The middle line is usually one of the following:
I send you this file in order to have your advice
I hope you can help me with this file that I send
I hope you like the file that I sendo you
This is the file with the information that you ask for
OR this text could arrive in Spanish.
The attached file may appear to be almost any kind of file, but will have
a hidden extensions that makes it a Windows Executable.
This Virus will likely arrive from someone you know, because it mails
itself to everyone in the Outlook address book of an infected computer.
Please be extremely wary of all file attachments.
The McAfeee Page for this Virus is
http://www.mcafee.com/anti-virus/viruses/sircam/default.asp?cid=2360
3. Unfortunately you can't simply remove the virus by running the virus scan - you have to manually alter your autoexec.bat file and your registry, otherwise the worm stays in your machine. You can get full instructions on the Norton Antivirus site. (This step may also be necessary
I hope this gives you the needed information.
........Larry