Introduction to the Sircam virus

The Sircam virus (code name W32.Sircam.Worm@mm, Backdoor.SirCam or Troj_Sircam.a) is a worm which spreads by email. At particular risk are users of Microsoft Outlook in Windows 95, 98, Millenium, and 2000.

What the virus does

The Sircam worm randomly selects a document (with the extension .gif, .jpg, .mpg, .jpeg, .mpeg, .mov, .pdf, .png, .ps or .zip) found in the directory c:\My Documents\ on the infected computer, then automatically sends an email whose subject is the name of that document, and whose body is one of the two following messages:

• In English:

  "Hi! How are you?
  I send you this file in order to have your advice
  See you later. Thanks"

  "Hi! How are you?
  I hope you can help me with this file that I send
  See you later. Thanks"

  "Hi! How are you?
  I hope you like the file that I send to you
  See you later. Thanks"

• Or in Spanish:

  "Hola como estas ?
  Te mando este archivo para que me des tu punto de vista
  Nos vemos pronto, gracias."

The Sircam worm also may delete all files on your hard drive on 16 October of each year if your computer uses the European date format (day/month/year).

Sircam also adds text to the file c:\recycled\sircam.sys each time your machine is restarted, which may potentially fill up available space on the C:\ drive.

Symptoms of infection

Infected machines have the following files on their hard drives:

• Sirc32.exe
• Sircam.sys
• Run32.exe

To check if you are infected, do a search for the files named above on all of your hard drives (Start / Search / For Files or Folders...).

Eradicating the virus

To eradicate the Sircam worm, the best method involves using an up-to-date antivirus software, or the virus removal tool offered by Symantec:
Download the virus removal tool

You can also remove the virus manually by following these steps:

• Delete the files Sirc32.exe and Sircam.sys
• Delete the file c:\windows\Runddl32.exe
• Rename the file c:\windows\Run32.exe to c:\windows\Rundll32.exe
• Edit the file c:\autoexec.bat  and delete the following sequence: @win \recycled\sirc32.exe
• In the registry (which can be modified by running c:\windows\regedit.exe)
  • In HKEY_CLASSES_ROOT/exefile/shell/open/command, edit the string (by double-clicking on Default) and entering the following string:

    "%1" %*

  • In HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/RunServices, delete the key Driver32=C:\WINDOWS\SYSTEM\SCam32.exe
  • In HKEY_LOCAL_MACHINE/Software, delete the folder Sircam
• Restart your computer

More information about the virus

• http://solutions.journaldunet.com/0107/010724.shtml
• http://vil.nai.com/vil/dispVirus.asp?virus_k=99141
• http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=TROJ_SIRCAM.B
• http://www.sophos.fr/virusinfo/analyses/w32sircama.html