The SirCam worm was first discovered in the wild on July 17th, 2001. Since that time, it has spread incredibly quickly, jumping up to the top ten threats within a matter of days. At the time of this writing in September, 2001, SirCam is still rated the number 2 virus threat on the internet.
This worm takes advantage of the Microsoft Outlook (and Outlook Express) "feature" known as email scripting, combined with clever social engineering. What happens is a person receives an email with a random subject from someone that he knows or has corresponded with. The message has an attachment (chosen randomly from the victims computer system) which, if opened, causes the virus to be executed.
It is very possible that even a careful user may be tricked into opening the attachment if he has "Hide file extensions for known file types" defined. This will cause the file type to potentially be hidden. Thus, the user might see it's a "PDF" file, when actually it is an "EXE" file. It is generally a good idea to always turn off "Hide file extensions for known file types" so you actually see what you are opening.
Here's how the virus works.
A person (let's call her Judy) receives an email with a title like "confidential payroll report". Of course she's intrigued and opens the attachment. The interesting thing about this virus is (as I understand it) the attachment is an actual document which can be viewed. This makes it more difficult to determine that you have been infected.
Judy's system is now infected.
All files on the C partition are deleted if the date is October 16 and the system is using D/M/Y as the date format, or if the attached file contains "FA2" not followed by "sc".
Under certain conditions the C drive may be filled as SirCam adds test to c:\recycled\sircam.sys.
The worm sends copies of itself with a random file attachment. The worm is appended to the attachment. SirCam has it's own SMTP engine so it just sends the copies itself. The attachment will have an extension of .bat, .com, .lnk, or .pif. The worm is 134kb long, so the attachment will be the length of the document plus 134kb.
The email addresses are taken from all *.wab (Windows Address Book) files in the %SYSTEM% folder. In addition, the internet cache is searched for web pages containing email addresses.
SirCam also searches for shared drives. If it finds any, it scatters copies of itself all over the drive.
One of the interesting facts about this worm is unless it causes damage, you may never know that you are infected! The worm will just keep sending. If you've got plenty of disk space, it will just slowly or quickly get filled up from the temporary files used by the emailing routine.
To prevent this worm you have be careful with your email.
I would highly recommend that all home Outlook users install the Microsoft Outlook Security patch. This will remove the possibility that this kind of virus can be opened.
Install and maintain an antivirus program.
Do not open any suspicious attachments (although the outlook patch and the antivirus program should take care of this).
SARC w32.sircam.word@mm - Excellent description of the worm, what it does and what to do about it.
Connect with me
Unless otherwise noted, all photos and text is Copyright © Richard G Lowe, Jr.