# Virus Warning **URL:** \ **Category:** Miscellaneous and Personal Stuff I Must Share\ **Created:** [July 30, 2001, 11:38am UTC](https://boards.straightdope.com/t/virus-warning/74213 "2001-07-30T11:38:02Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![Spider\_Woman](https://avatars.discourse-cdn.com/v4/letter/s/cdc98d/32.png) [@Spider\_Woman](https://boards.straightdope.com/u/Spider_Woman)\ **Post date:** [July 30, 2001, 11:38am UTC](https://boards.straightdope.com/t/virus-warning/74213/1 "2001-07-30T11:38:02Z")
My daughter has informed me that there is a new virus. Also, **imthjckaz** heard about it on the news this morning. It is called the Code Red Worm virus, and the subject line says: “Hola! Como estas?” in Spanish (I don’t think I got the Spanish right; sorry) or “Hello! How are you?” in English. Don’t open any e-mail that says that! I think it also has an .exe in the subject line, but I could be wrong. My daughter received three copies already, which she deleted. ---
**Author:** ![AHunter3](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ahunter3/32/368_2.png) [@AHunter3](https://boards.straightdope.com/u/AHunter3)\ **Post date:** [July 30, 2001, 12:03pm UTC](https://boards.straightdope.com/t/virus-warning/74213/2 "2001-07-30T12:03:57Z")
I don’t think that one is the Code Red, Spidey. I’m pretty sure that one is the SirCam worm. And it’s safe to open the email, it just isn’t safe to open the attached file. (This is almost always the case with any virus). I got 4 copies in English. The Spanish versions are less common. The Code Red virus affects servers running NT and its successors, and is mainly designed to hack the web pages hosted by those servers. It also has a nasty attitude towards Cisco routers, I hear. At any rate, they are two different buggies. ---
**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\ **Post date:** [July 30, 2001, 12:10pm UTC](https://boards.straightdope.com/t/virus-warning/74213/3 "2001-07-30T12:10:49Z")
That’s SirCam. Don’t worry about Code Red. It only affects webservers. ---
**Author:** ![Spider\_Woman](https://avatars.discourse-cdn.com/v4/letter/s/cdc98d/32.png) [@Spider\_Woman](https://boards.straightdope.com/u/Spider_Woman)\ **Post date:** [July 30, 2001, 12:11pm UTC](https://boards.straightdope.com/t/virus-warning/74213/4 "2001-07-30T12:11:54Z")
Shows ya what I know! But anyway, I hope the word gets out, whatever it is. My daughter received the Spanish version. Does it only go to people with web pages (she has a least two)? Anyway, thanks for the correct information, **AHunter3**! ----:)/ x o x o x ----///\\ ---
**Author:** ![slortar](https://avatars.discourse-cdn.com/v4/letter/s/6bbea6/32.png) [@slortar](https://boards.straightdope.com/u/slortar)\ **Post date:** [July 30, 2001, 12:41pm UTC](https://boards.straightdope.com/t/virus-warning/74213/5 "2001-07-30T12:41:15Z")
Basically, part of what it does is it scans your browser cache and address book for e-mail messages, and sends copies of itself all over the place. It draws from random files from your hard drive for the subject header and the name of the attachment. I got 14 copies over the weekend–maybe 50 total since the virus hit. I **really** hope they track this guy down and make him pay… ---
**Author:** ![wring](https://avatars.discourse-cdn.com/v4/letter/w/838e76/32.png) [@wring](https://boards.straightdope.com/u/wring)\ **Post date:** [July 30, 2001, 1:30pm UTC](https://boards.straightdope.com/t/virus-warning/74213/6 "2001-07-30T13:30:54Z")
How ironic is this: a friend of mine sent me an email to warn me about this, said email warning warned that it attacked through attachments to common emails - of course, she **sent** it as an attachment. Sigh. ---
**Author:** ![CrankyAsAnOldMan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/crankyasanoldman/32/11670_2.png) [@CrankyAsAnOldMan](https://boards.straightdope.com/u/CrankyAsAnOldMan)\ **Post date:** [July 30, 2001, 2:02pm UTC](https://boards.straightdope.com/t/virus-warning/74213/7 "2001-07-30T14:02:12Z")
Yeah, I thought I was all done getting that Sir Cam thing, but today another one arrived. Which makes me total times receiving it to be something like 26. ---
**Author:** ![lno](https://avatars.discourse-cdn.com/v4/letter/l/a8b319/32.png) [@lno](https://boards.straightdope.com/u/lno)\ **Post date:** [July 30, 2001, 3:44pm UTC](https://boards.straightdope.com/t/virus-warning/74213/8 "2001-07-30T15:44:55Z")
I’ve received absolutely 0 SirCam emails. I can’t decide if I should be happy that I dodged a bullet, or sad that apparently no one likes me enough to have me in their address book. [sub]lousy beatniks[/sub] ---
**Author:** ![slortar](https://avatars.discourse-cdn.com/v4/letter/s/6bbea6/32.png) [@slortar](https://boards.straightdope.com/u/slortar)\ **Post date:** [July 30, 2001, 5:01pm UTC](https://boards.straightdope.com/t/virus-warning/74213/9 "2001-07-30T17:01:56Z")
> [@](#): > > \*Originally posted by LNO \* > \*\*I’ve received absolutely 0 SirCam emails. > > I can’t decide if I should be happy that I dodged a bullet, or sad that apparently no one likes me enough to have me in their address book. > [sub]lousy beatniks[/sub] \*\* I could send you a few dozen copies, if you really want. I must have gotten 40 or 50 of the damn things over the last week. Plenty to spare. ---
**Author:** ![London\_Calling](https://avatars.discourse-cdn.com/v4/letter/l/49beb7/32.png) [@London\_Calling](https://boards.straightdope.com/u/London_Calling)\ **Post date:** [July 31, 2001, 1:07am UTC](https://boards.straightdope.com/t/virus-warning/74213/10 "2001-07-31T01:07:40Z")
Quoting from Uncle Bill’s site: “Who Must Act? Every organization or person who has **Windows NT or Windows 2000** systems **AND** the IIS web server software may be vulnerable. IIS is installed automatically for many applications. If you are not certain, follow the instructions to determine whether you are running IIS 4.0 or 5.0. **If you are using Windows 95, Windows 98, or Windows Me, there is no action that you need to take in response to this alert.** ” > **[Developer tools, technical documentation and coding examples](https://docs.microsoft.com/en-us/?url=%2Ftechnet%2Fitsolutions%2Fsecurity%2Ftopics%2Fcodealrt.asp)** > > The home for Microsoft documentation and learning for developers and technology professionals. ---
**Author:** ![AHunter3](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ahunter3/32/368_2.png) [@AHunter3](https://boards.straightdope.com/u/AHunter3)\ **Post date:** [July 31, 2001, 1:18am UTC](https://boards.straightdope.com/t/virus-warning/74213/11 "2001-07-31T01:18:21Z")
The quotation that London\_Calling is referring to is a quotation about the Code Red virus, not the SirCam worm. Both viruses are under discussion in this thread. ---
**Author:** ![London\_Calling](https://avatars.discourse-cdn.com/v4/letter/l/49beb7/32.png) [@London\_Calling](https://boards.straightdope.com/u/London_Calling)\ **Post date:** [July 31, 2001, 1:30am UTC](https://boards.straightdope.com/t/virus-warning/74213/12 "2001-07-31T01:30:59Z")
Oops, I should have made that clear. Nicely caught, **AHunter3**. ---
**Author:** ![Ruffian](https://avatars.discourse-cdn.com/v4/letter/r/71e660/32.png) [@Ruffian](https://boards.straightdope.com/u/Ruffian)\ **Post date:** [July 31, 2001, 1:45am UTC](https://boards.straightdope.com/t/virus-warning/74213/13 "2001-07-31T01:45:15Z")
I just sent this out to basically everyone in my address book. Note, this is **not the Code Red or Sir Cam** virus…it’s just your everyday worm, out to do damage and pass it on: > [@](#): > > Most of y’all know that I’m no fan of chain virus-warning emails. The majority of them are fakes, and typically are worded the same way (“don’t even open it!” “it will wipe out your hard drive!” “much worse than ------- [whatever the current virus scare is]!”). These bogus emails are designed to basically create a false panic among those who may not know better (to the author’s amusement, unfortunately), and also have been known to do their own share of damage by bogging down servers with their endless chain-email-effect. > > _This_ is very, very real. First, the two most basic rules of internet/email virus protection: > > 1. Never, ever, _ **EVER** _ download an attached file from an unknown sender, no matter how benign their name/subject may be. This is _especially_ true if the attached file is a .exe file. And…EVEN IF YOU KNOW THE SENDER, BE SUSPICIOUS IF THEIR EMAIL DOESN’T “SOUND” LIKE THEM–AND IF THEY DON’T SIGN THEIR NAME! (this is where virus protection comes in handy–it can scan attached files for you) > > 2. No matter what chain-email-gossip-urban legend says, you can **NOT** get a virus _ **just from OPENING an email.** _ Viruses are tranmitted over the Net by not following rule #1. It is simply not possible to get it from reading a letter, and the more tech-savy of you out there would be better at explaining it than I. Let’s put it this way: going to the mailbox won’t let an intruder into your house. Opening your door (downloading a file) will. > > That said, here’s what’s happened. Someone close to us had a worm (a more insidious type of computer-damaging virus). This worm came disguised in an email attachment _from someone they knew_. They downloaded the file, and the worm did two things: 1) it infiltrated their addressbook and _sent itself on to everyone in it_, and 2) it started doing some serious damage to their computer. All infected files could only be deleted, not repaired. > > Both my husband and I received such a self-replicating virus email from the hapless victim and we immediately deleted it after reading its text. (Just to further exemplify rule #2–opening the email did no damage to either of our computers.) The text of the email was very, very suspicious, saying something along the lines of “I send this to you for your input,” or something awkward like that. Unfortunately, I don’t remember the subject header–something about Excel, I think. The email was not signed, and bore no resemblance to this person’s actual writing style. The attached file was a “.exe” file, which likely if not certainly would have infiltrated **our** address books and come to all of you had we downloaded it. > > \*[Note: a friend did indeed receive this email and its attached virus the day after I sent this warning. She adds that the text within the email reads: > > "Hi! How are you? > > I send you this file in order to have your advice > > See you later. Thanks" > > Is it me, or does that sound like a second-language learner?]\* > > So–be on the lookout. This kind of self-replicating virus can spread like wildfire, as you might imagine, and it is very possible some of you will see this thing in your mailbox soon. > > A final tip…be sure to keep your important files backed up. I’m sure I’m preaching to the choir with some, if not even most of you, but it takes a disaster like this to even remind _me_ it’s back-up time. (That, and it’s also time to update my virus protection software–new viruses come out every month, so I need to download the latest stuff from Norton.) So, there you have it. Anyone seeing this one come into their mailboxes? ---
**Author:** ![AHunter3](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ahunter3/32/368_2.png) [@AHunter3](https://boards.straightdope.com/u/AHunter3)\ **Post date:** [July 31, 2001, 3:45am UTC](https://boards.straightdope.com/t/virus-warning/74213/14 "2001-07-31T03:45:18Z")
Ruffian–that’s SirCam! ---
**Author:** ![Spider\_Woman](https://avatars.discourse-cdn.com/v4/letter/s/cdc98d/32.png) [@Spider\_Woman](https://boards.straightdope.com/u/Spider_Woman)\ **Post date:** [July 31, 2001, 11:40am UTC](https://boards.straightdope.com/t/virus-warning/74213/15 "2001-07-31T11:40:44Z")
Thanks for the advice. ---
**Author:** ![techchick68](https://avatars.discourse-cdn.com/v4/letter/t/ea5d25/32.png) [@techchick68](https://boards.straightdope.com/u/techchick68)\ **Post date:** [July 31, 2001, 11:49am UTC](https://boards.straightdope.com/t/virus-warning/74213/16 "2001-07-31T11:49:41Z")
Just to help with this, here is the official Microsoft warning on this worm: > [@](#): > > The following is a Security Bulletin from the Microsoft Product Security > Notification Service. > > Please do not reply to this message, as it was sent from an unattended > mailbox. > \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* > > -----BEGIN PGP SIGNED MESSAGE----- > > * * * > > The Microsoft Security Response Center, along with other > organizations listed below, is jointly publishing this alert that > ALL IIS ADMINISTRATORS ARE ASKED TO READ > > A Very Real and Present Threat to the Internet: > July 31 Deadline For Action > > Summary: > > The Code Red Worm and mutations of the worm pose a > continued and serious threat to Internet users. Immediate action > is required to combat this threat. Users who have deployed > software that is vulnerable to the worm (Microsoft IIS > Versions 4.0 and 5.0) must install, if they have not done so > already, a vital security patch. > > How Big Is The Problem? > > On July 19, the Code Red worm infected more than 250,000 systems > in just 9 hours. The worm scans the Internet, identifies > vulnerable systems, and infects these systems by installing > itself. Each newly installed worm joins all the others causing > the rate of scanning to grow rapidly. This uncontrolled growth > in scanning directly decreases the speed of the Internet and > can cause sporadic but widespread outages among all types of > systems. Code Red is likely to start spreading again on > July 31st, 2001 8:00 PM EDT and has mutated so that it may be > even more dangerous. This spread has the potential to disrupt > business and personal use of the Internet for applications such > as electronic commerce, email and entertainment. > > Who Must Act? > > Every organization or person who has Windows NT or Windows 2000 > systems AND the IIS web server software may be vulnerable. > IIS is installed automatically for many applications. If you > are not certain, follow the instructions attached to determine > whether you are running IIS 4.0 or 5.0. If you are using > Windows 95, Windows 98, or Windows Me, there is no action that > you need to take in response to this alert. > > What To Do If You Are Vulnerable? > > a. To rid your machine of the current worm, reboot your computer. > b. To protect your system from re-infection: > Install Microsoft’s patch for the Code Red vulnerability problem: > > - > - Windows NT version 4.0: > [http://www.microsoft.com/Downloads/Release.asp?ReleaseID=30833](http://www.microsoft.com/Downloads/Release.asp?ReleaseID=30833) > > - > - Windows 2000 Professional, Server and Advanced Server: > [http://www.microsoft.com/Downloads/Release.asp?ReleaseID=30800](http://www.microsoft.com/Downloads/Release.asp?ReleaseID=30800) > > Step-by-step instructions for these actions are posted at > [http://www.microsoft.com/technet/treeview/default.asp](http://www.microsoft.com/technet/treeview/default.asp)? > url=/technet/itsolutions/security/topics/codeptch.asp > > Microsoft’s description of the patch and its installation, > and the vulnerability it addresses is posted at: > [http://www.microsoft.com/technet/treeview/default.asp](http://www.microsoft.com/technet/treeview/default.asp)? > url=/technet/security/bulletin/MS01-033.asp > > Because of the importance of this threat, this alert is > being made jointly by: > > Microsoft > The National Infrastructure Protection Center > Federal Computer Incident Response Center (FedCIRC) > Information Technology Association of America (ITAA) > CERT Coordination Center > SANS Institute > Internet Security Systems > Internet Security Alliance > > -----BEGIN PGP SIGNATURE----- > Version: PGP Personal Privacy 6.5.3 > > iQEVAwUBO2Wpgo0ZSRQxA/UrAQFQeQgAgmva53MJdjGF4u4oFXcAJICgf+1YTd1n > IJ7XIPPjTFkc5/8Fqe0lbFY7ZeBNAvGGI276RPkebmTz1WAJ08MNe9uvMJAuyULw > nOU8sMIO7S0Z5Z65/UYow0ui2qLVdmioqf809RAydHPdj1GINU0yDNS1HwwfjZia > 0wBN+GjyjbdMU6bgMadoMdRgvCwdx2Jzr8ExAnFeNtLxRjwct3mv23bCrln1h80I > 4awW0GPPd5iFzLIZX+QVh9/qkPdYm3SD1e8rs8GK69dub1AsVoKdXea+EHb3YckO > 9XfuZdhxy6I+PnZJ8woSSNqtuZ2zKuS+q4kdPt0Abh0ToCbR4jK91A== > =a2a5 > -----END PGP SIGNATURE----- > > * * * > > You have received this e-mail bulletin as a result of your registration > to the Microsoft Product Security Notification Service. You may > unsubscribe from this e-mail notification service at any time by sending > an e-mail to [MICROSOFT\_SECURITY-SIGNOFF-REQUEST@ANNOUNCE.MICROSOFT.COM](mailto:MICROSOFT_SECURITY-SIGNOFF-REQUEST@ANNOUNCE.MICROSOFT.COM) > The subject line and message body are not used in processing the request, > and can be anything you like. > > To verify the digital signature on this bulletin, please download our PGP > key at [http://www.microsoft.com/technet/security/notify.asp](http://www.microsoft.com/technet/security/notify.asp). > > For more information on the Microsoft Security Notification Service > please visit [http://www.microsoft.com/technet/security/notify.asp](http://www.microsoft.com/technet/security/notify.asp). For > security-related information about Microsoft products, please visit the > Microsoft Security Advisor web site at [http://www.microsoft.com/security](http://www.microsoft.com/security). Look, as it is, we average users shouldn’t have a problem with this worm…as far as I can tell it’s not a high warning virus for average users. But still, keep up on your virus protection, never open a file sent to you from someone you don’t know, double check the file name…aka if you see a file that says blahblahblah.doc.rol or blahblahblah.doc.vbs, chances are it’s a bad file. If if said “blahblahblah.doc” you might be okay assuming that there aren’t any macro viruses…but if you didn’t ask for it, it has an extra dot in the file name or from someone you don’t know, it’s virus. Keep an eye on Symantec’s and McAfee’s websites and you will be aware of problem viruses and worms that are hitting the net. ---
**Author:** ![nightshadea](https://avatars.discourse-cdn.com/v4/letter/n/7ba0ec/32.png) [@nightshadea](https://boards.straightdope.com/u/nightshadea)\ **Post date:** [July 31, 2001, 12:01pm UTC](https://boards.straightdope.com/t/virus-warning/74213/17 "2001-07-31T12:01:44Z")
this sir cam is a net version of whats known as the buddy list virus on aol what it does is it copies your buddy list and sends every one a file attachment that says " hi heres my pic finally " but the odd thing is it dosent do anything thats been reported so current thought is its just a " see what i made virus" or its a screen name harvester for junk mail the kid probably graduated from aol to the net with this dumb thing ---
**Author:** ![Ruffian](https://avatars.discourse-cdn.com/v4/letter/r/71e660/32.png) [@Ruffian](https://boards.straightdope.com/u/Ruffian)\ **Post date:** [August 3, 2001, 4:55pm UTC](https://boards.straightdope.com/t/virus-warning/74213/18 "2001-08-03T16:55:24Z")
You were right, AHunter…I actually hadn’t hear its name yet when I emailed the letter, and the descriptions here just didn’t sound familiar at the time. We’ve been sent Sircam-attached emails twice more since the original emailing. I sent out this update: > [@](#): > > Okay, we have learned this is the “Sircam” virus circulating around. Brian’s actually been sent it again by another friend, and a friend of mine received the virus (but fortunately deleted it) two days after I sent the email. > > Information about Sircam (as well as Norton’s tools for its removal) are located here: [http://www.symantec.com/avcenter/venc/data/w32.sircam.worm@mm.html](http://www.symantec.com/avcenter/venc/data/w32.sircam.worm@mm.html) > It’s a fascinating read. The thing goes through your MyDocuments folder, snags a document, and attaches itself to it before sending itself through your address book. The text of the email, verbatim, is also listed here. (It’s also listed in Spanish! Apparently, it gets around!)