The Sircam virus

May 2015

Introduction to the Sircam virus

The Sircam virus (code name W32.Sircam.Worm@mm, Backdoor.SirCam or Troj_Sircam.a) is a worm which spreads by email. At particular risk are users of Microsoft Outlook in Windows 95, 98, Millenium, and 2000.

What the virus does

The Sircam worm randomly selects a document (with the extension .gif, .jpg, .mpg, .jpeg, .mpeg, .mov, .pdf, .png, .ps or .zip) found in the directory c:\My Documents\ on the infected computer, then automatically sends an email whose subject is the name of that document, and whose body is one of the two following messages:

  • In English:
    "Hi! How are you?
    I send you this file in order to have your advice
    See you later. Thanks"
    "Hi! How are you?
    I hope you can help me with this file that I send
    See you later. Thanks"
    "Hi! How are you?
    I hope you like the file that I send to you
    See you later. Thanks"
  • Or in Spanish:
    "Hola como estas ?
    Te mando este archivo para que me des tu punto de vista
    Nos vemos pronto, gracias."
The Sircam virus attaches a copy of itself whose name is that of the file found on the user's hard drive, with a double .vbs as its file extension.

The Sircam worm also may delete all files on your hard drive on 16 October of each year if your computer uses the European date format (day/month/year).

Sircam also adds text to the file c:\recycled\sircam.sys each time your machine is restarted, which may potentially fill up available space on the C:\ drive.

Symptoms of infection

Infected machines have the following files on their hard drives:

  • Sirc32.exe
  • Sircam.sys
  • Run32.exe

To check if you are infected, do a search for the files named above on all of your hard drives (Start / Search / For Files or Folders...).

Eradicating the virus

To eradicate the Sircam worm, the best method involves using an up-to-date antivirus software, or the virus removal tool offered by Symantec:
Download the virus removal tool

You can also remove the virus manually by following these steps:

  • Delete the files Sirc32.exe and Sircam.sys
  • Delete the file c:\windows\Runddl32.exe
  • Rename the file c:\windows\Run32.exe to c:\windows\Rundll32.exe
  • Edit the file c:\autoexec.bat  and delete the following sequence: @win \recycled\sirc32.exe
  • In the registry (which can be modified by running c:\windows\regedit.exe)
    • In HKEY_CLASSES_ROOT/exefile/shell/open/command, edit the string (by double-clicking on Default) and entering the following string:
      "%1" %*
    • In HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/RunServices, delete the key Driver32=C:\WINDOWS\SYSTEM\SCam32.exe
    • In HKEY_LOCAL_MACHINE/Software, delete the folder Sircam
  • Restart your computer

More information about the virus

For unlimited offline reading, you can download this article for free in PDF format:
The-sircam-virus .pdf

See also


El virus Sircam
El virus Sircam
Le virus Sircam
Le virus Sircam
Le ver Sircam
Le ver Sircam
Il virus Sircam
Il virus Sircam
O vírus Sircam
O vírus Sircam
This document entitled « The Sircam virus » from Kioskea (en.kioskea.net) is made available under the Creative Commons license. You can copy, modify copies of this page, under the conditions stipulated by the license, as this note appears clearly.