 |
| Viruses Some viruses Tools More information |
The Sircam virus (code name W32.Sircam.Worm@mm, Backdoor.SirCam or Troj_Sircam.a) is a worm which spreads by email. At particular risk are users of Microsoft Outlook in Windows 95, 98, Millenium, and 2000.
The Sircam worm randomly selects a document (with the extension .gif, .jpg, .mpg, .jpeg, .mpeg, .mov, .pdf, .png, .ps or .zip) found in the directory c:\My Documents\ on the infected computer, then automatically sends an email whose subject is the name of that document, and whose body is one of the two following messages:
"Hi! How are you?
I send you this file in order to have your advice
See you later. Thanks"
"Hi! How are you? I hope you can help me with this file that I send See you later. Thanks"
"Hi! How are you? I hope you like the file that I send to you See you later. Thanks"
"Hola como estas ?
Te mando este archivo para que me des tu punto de vista
Nos vemos pronto, gracias."
The Sircam worm also may delete all files on your hard drive on 16 October of each year if your computer uses the European date format (day/month/year).
Sircam also adds text to the file c:\recycled\sircam.sys each time your machine is restarted, which may potentially fill up available space on the C:\ drive.
Infected machines have the following files on their hard drives:
To check if you are infected, do a search for the files named above on all of your hard drives (Start / Search / For Files or Folders...).
To eradicate the Sircam worm, the best method involves using an up-to-date antivirus software, or the virus removal tool offered by Symantec:
Download the virus removal tool
You can also remove the virus manually by following these steps:
"%1" %*
