WORM SPREADS USING E-MAIL ATTACHMENTS
Virus Name : W32.SirCam.Worm@mm
Alias : I-Worm.SirCam,
Virus type : Internet
level : Medium
is a mass mailing worm uses e-mail addresses
stored in Windows Address book and also collects
addresses from temporary Internet folder to
distribute infected messages. SirCam is also
network aware worm. It searches for network
shares and infects them too. SirCam worm is also
known as I-Worm.SirCam, W32.SirCam.Worm,
W32.SirCam or WORM_SIRCAM.A.
arrives as an e-mail attachment, message subject
and body varies randomly. The message body first
and last line will be the same. The worm will
contain two extensions, first will be DOC, XLS,
ZIP and EXE and the second extension selected randomly from PIF, LNK,
BAT or COM. The mail subject and body will be in English
Hi! How are
Last Line: See you later. Thanks
When sending the infected
message, the worm will append a file from the
local system to disguise the user. The attached
infected file will contain double extension like
secret.doc.pif, compress.zip.bat. It
will e-mail the infected files using its own SMTP
If the infected e-mail
attachment is executed, the worm code executed
first. It copies itself to the file SCam32.exe in
the windows folder. The worm also drops
Sirc32.exe in the Recycle bin with hidden
attribute. After that it activates the
corresponding application. The worm is loaded
automatically by changing the following keys in
Then it searches for
network share, if found it copies to RUNDLL32.EXE
file. The original RUNDLL32.EXE file is renamed
to RUN32.EXE. It also adds the entry @win
\recycled\SirC32.exe in the AUTOEXEC.BAT to load
it on the next startup.
SirCam worm contains
destructive payloads. When the payload is
activated SirCam will delete all files
and directories. When sending infected
attachments, it distributes files from the
system. So the infected user may loose
can I protect my system?
Solo has incorporated
W32.Sircam.Worm@mm in its signature file to
protect users from this worm attack. Solo
antivirus registered users are already protected
from this worm. Make sure that you have installed
registered version of Solo Antivirus to protect
you from all virus threats.
to remove SirCam worm?
can check the system manually. W32.SirCam.Worm@mm
creates the file "SIRC32.EXE" in
Recycled folder. The
presence of this file ensures you are infected
with this worm.
Worm changes registry keys when infecting the
machine and it should be fixed before deleting
the main worm file "SIRC32.EXE"
stored in Recycled folder.
you are already infected with this worm, you can
remove it from your computer using Solo Antivirus
software. Solo antivirus can detect and
remove W32.SirCam.Worm@mm safely. Use
the following link to Download 30 day
trial version of Solo antivirus
remove viruses from your computer.
Solo anti-virus not only
scans for all viruses, it contains a unique System
Integrity Checker to protect you from
New Internet Worms, Backdoors and
malicious VB, Java Scripts. It also
effectively removes all existing Internet Worms,
File viruses, malicious VB and Java scripts,
Trojans, Backdoors, boot sector, partition table
and macro viruses.
purchase Solo antivirus using the link