# MA-031.072001: MyCERT Advisory - W32SIRCAM@MM Worm

**Date:** 24 Jul 2001  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-031.072001  
**Advisory ID:** MA-031.072001

---

1.0 Description
#### 1.1 Overview
The W32/SirCam@MM is a mass-mailing worm attempts to send itself and local documents to all users found in the Windows Address Book and email addresses found in temporary Internet cached files (web browser cache). The risk assessment by many anti-virus vendors, for this worm has been upgraded to a HIGH risk due to its increased rate of submissions.
#### 1.2 Limitation
The worm will only be activated once the attachment appended with the email is executed.
#### 1.3 Aliases
The worm is also known as:
TROJ\_SIRCAM.A
Backdoor.SirCam
W32.Sircam.Worm@mm
#### 1.4 Payload
Payload triggers on October 16th - this applies only to the payload which deletes files.
- **Large scale e-mailing:**
The worm appends a random document from the infected PC to itself and sends this new file via email
- **Deletes files:**
1 in 20 chance of deleting all files and directories on C:. Only occurs on systems using D/M/Y as the date format
- **Degrades performance:**
1 in 33 chance of filling all remaining space on the hard disk by adding text to the file c:\recycled\sircam.sys at each startup
- **Releases confidential info:**
It will export a random document from the hard drive by appending it to the body of the worm.
### 2.0 Technical Matters
#### 2.1 Functionality (as extracted from Mcafee)
The worm may be received in an email message containing the following information:
**Subject:**
Random subject. In some cases it will be the filename of the attachment [filename as grepped from the victim's infected PC (random)]
**Body:**
The message body will be semi-random, but will always contain one of the following two lines (either English or Spanish) as the first and last sentences of the message.
|  |
| --- | --- | --- |  | **Spanish Version** | **English Version** | **First line** | Hola como estas? | Hi! How are you? | **Last line** | Nos vemos pronto, gracias. | See you later. Thanks |
Between these two sentences, some of the following text may appear:
|  | --- | --- | **Spanish Version** | **English Version** | Te mando este archivo para que me des tu punto de vista  Espero me puedas ayudar con el archivo que te mando  Espero te guste este archivo que te mando  Este es el archivo con la informaci=n que me pediste | I send you this file in order to have your advice  I hope you can help me with this file that I send  I hope you like the file that I send you  This is the file with the information that you ask for |
**Attachment:**
Document with a double extension, .com.exe, .doc.pif, .doc.bat (the filename varies).
The first extension will be the file type which was appended by the virus. When run, the document will be saved to the C:\RECYCLED folder and then opened while the virus copies itself to C:\RECYCLED\SirC32.exe folder to conceal its presence and creates the following registry key value to load itself whenever .EXE files are executed:
HKCR\exefile\shell\open\command\Default="C:\recycled\SirC32.exe" "%1" %\*
As the RECYCLE BIN is often on the exclusion list, check your settings to insure that this directory IS being scanned.
It also copies itself to the WINDOWS SYSTEM directory as SCam32.exe and creates the following registry key value to load itself automatically:
HKLM\Software\Microsoft\Windows\CurrentVersion \RunServices\Driver32=C:\WINDOWS\SYSTEM\SCam32.exe
A list of .GIF, .JPG, .JPEG, .MPEG, .MOV, .MPG, .PDF, .PNG, .PS, and .ZIP files in the MY DOCUMENTS folder is saved to the file SCD.DLL (the 2nd character of the name appears to be random) in the SYSTEM directory. Email addresses are gathered from the Windows Address Book and temporary Internet cached pages and saved to the file SCD1.DLL (the 2nd and 3rd character of the name appears to be random) in the SYSTEM directory.
The worm prepends a copy of the files that are named in the SCD.DLL file and attaches this copy to the email messages that it sends via a built in for communicating directly with a SMTP server, using one of the following extensions: **.BAT, .COM, .EXE, .LNK, .PIF.** This results in attachment names having double-extensions such as:
.doc.pif
.doc.bat
.com.exe
The program creates a registry key to store variables for itself (such as a run count, and SMTP information):
HKLM\Software\Sircam
The virus may also infect other systems by using open network shares. On remote systems the file \windows\rundll32.exe might get replaced with a viral copy. On those systems, it might also append the autoexec.bat with the line: @win \recycled\sirc32.exe.
Aside from e-mail overloading, it might delete files on 16 October and/or fill up hard disk space by adding text entries over & over again to a sircam recycle bin file.
### 3.0 Possible Steps
#### 3.1 Prevention
DO NOT execute any attachment appended with email and do not open any email attachments with the extensions mentioned as in 2.1.
Do not open any suspicious/unknown attachments and delete them immediately. Regularly update the virus definition file of your antivirus software and run a virus scan on the computer. This is to ensure that the software is able to detect the presence of a new virus. The list of known antivirus vendor can be found at:
[https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=b83f4c4d-f1e2-4a9d-ab55-6389ae1f6efc](https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=b83f4c4d-f1e2-4a9d-ab55-6389ae1f6efc
)
Always run a virus scan on any downloadable files before executing it. It is advisable that your antivirus software is running in "Auto Protect Mode" at all time.
Refer to Safe Email Practices:
[https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=96fa0022-2ca9-47cb-975f-0d1225cc278e](https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=96fa0022-2ca9-47cb-975f-0d1225cc278e
)
Large organisations are recommended to filter email attachments, primarily those with extensions .EXE, .COM, .BAT, .PIF, .LNK and in previous worm involves .VBS\* attachments. It is also recommended to scan email at the gateway for virus.
#### 3.2 Detection
Any antivirus with the latest virus definitions is able to detect the worm. To detect the virus, run an antivirus scan with the latest signature file on your system. Ensure the anti-virus is configured to scan ALL FILES, or if selected files, ensure the relevant extensions such as .PIF and .LNK is included.
#### 3.3 Removal
1. **Automatic removal: Download Fix tool provided by Symantec**
Refer at:
http://www.sarc.com/avcenter/venc/data/[[email protected]](/cdn-cgi/l/email-protection)
2. **Manual removal (as extracted from Symantec)**
- Delete any files detected as W32.Sircam.Worm@mm.
- Empty the Recycle bin to delete Sircam.sys (if it exists).
- Remove the entry that it made to the Autoexec.bat file
- Revert the change that it made to the registry key
HKEY\_CLASSES\_ROOT\exefile\shell\open\command
Detail instructions by symantec:
http://www.symantec.com/avcenter/venc/data/[[email protected]](/cdn-cgi/l/email-protection)
3. **Follow Steps Given By NAI**
http://vil.nai.com/vil/content/v\_99141.htm
### 4.0 More Information
To obtain more information on this rootkit, please refer to the following site:
4.1 McAfee
http://vil.nai.com/vil/content/v\_99141.htm
4.2 Symantec Antivirus Research Center
http://www.symantec.com/avcenter/venc/data/[[email protected]](/cdn-cgi/l/email-protection)