"W32/Sircam" is malicious code that spreads through email and
potentially through unprotected network shares and through all versions of Microsoft Windows (all versions). Once the malicious code has been executed on a system, it may reveal or delete sensitive information.
As of 10:00EST(GMT-4) Jul 25, 2001 the CERT/CC has received reports of W32/Sircam from over 300 individual sites. http://tech.msn.com/ip/msnart82.asp
I. Description:
W32/Sircam can infect a machine in one of two ways:
- When executed by opening an email attachment containing the
malicious code
- By copying itself into unprotected network shares
Propagation Via Email
The virus can appear in an email message written in either English or Spanish with a seemingly random subject line. All known versions of
W32/Sircam use the following format in the body of the message:
- English
- Hi! How are you?
- [middle line]
- See you later. Thanks
- Spanish
- Hola como estas ?
- [middle line]
- Nos vemos pronto, gracias.
- Where [middle line] is one of the following:
- English
- I send you this file in order to have your advice
- I hope you like the file that I sendo you
- I hope you can help me with this file that I send
- This is the file with the information you ask for
- Spanish
- Te mando este archivo para que me des tu punto de vista
- Espero te guste este archivo que te mando
- Espero me puedas ayudar con el archivo que te mando
- Este es el archivo con la informacion que me pediste
Users who receive copies of the malicious code through electronic
mail might recognize the sender. We encourage users to avoid opening attachments received through electronic mail, regardless of the sender's name, without prior knowledge of the origin of the file or a valid digital signature.
The email message will contain an attachment whose name matches the subject line and has a double file extension (e.g. subject.ZIP.BAT or subject.DOC.EXE). The CERT/CC has confirmed reports that the first extension may be .DOC, .XLS, or .ZIP. Anti-virus vendors have referred to additional extensions, including .GIF, .JPG, .JPEG, .MPEG, .MOV, .MPG, .PDF, .PNG, and .PS. The second extension will be .EXE, .COM, .BAT, .PIF, or .LNK. The attached file contains both the malicious code and the contents of a file copied from an infected
system.
When the attachment is opened, the copied file is extracted to both the %TEMP% folder (usually C:\WINDOWS\TEMP) and the Recycled folder on the affected system. The original file is then opened using the appropriate default viewer while the infection process continues in the background.
It is possible for the recipient to be tricked into opening this malicious
attachment since the file will appear without the .EXE, .BAT, .COM,
.LNK, or .PIF extensions if the "Hide file extensions for known file
types" is enabled in Windows. See IN-2000-07 for additional information
on the exploitation of hidden file extensions.
**See the ITS Virus Info page instructions
on how to show file extensions**
W32/Sircam includes its own SMTP client capabilities, which it uses
to propagate via email.
- By copying itself into unprotected network shares
In addition to email-based propagation, analysis by anti-virus
vendors suggests that W32/Sircam can spread through
unprotected network shares. Unlike the email propagation method,
which requires a user to open an attachment to infect the machine,
propagation of W32/Sircam via network shares requires no human
intervention.
II. Impact
W32/Sircam can have a direct impact on both the computer which was infected as well as those with which it communicates over email.
* Breaches of confidentiality: The malicious code will at a minimum search through select folders and mail potentially sensitive files. This form of attack is extremely serious since it is one from which it is impossible to recover. Once a file has been publicly distributed, any potentially sensitive information in it cannot be retracted.
* Limit Availibility (Denial of Service)
- Fill entire hard drive: Based on external analyses, on any
given day, there is a probability that it will create a file
named C:\Recycled\sircam.sys which consumes all free space on the C: drive. A full disk will prevent users from saving
files to that drive, and in certain configurations impede
system-level tasks (e.g., swapping, printing).
- Propagation via mass emailing: W32/Sircam will attempt to
propagate by sending itself through email to addresses
obtained as described above. This propagation can lead to
congestion in mail servers that may prevent them from
functioning as expected.
- NOTE: Since W32/Sircam uses native SMTP routines connecting to pre-defined mail servers, propagation is independent of the mail client software used.
- * Loss of Integrity: Published reports indicate that on October 16 there is a reasonable probability that W32/Sircam will attempt to recursively delete all files from the drive on which Windows isinstalled (typically C:).
III. Solution:
Run and Maintain an Anti-Virus Product
It is important for users to update their anti-virus software. Most
anti-virus software vendors have released updated information, tools, or virus databases to help detect and partially recover from this malicious code. A list of vendor-specific anti-virus information can be found in Appendix A.
Many anti-virus packages support automatic updates of virus definitions. We recommend using these automatic updates when available.
Exercise Caution When Opening Attachments
Exercise caution when receiving email with attachments. Users should never open attachments from an untrusted origin, or ones that appear suspicious in any way. Finally, cryptographic checksums should also be used to validate the integrity of the file.
The effects of this class of malicious code are activated only when
the file in question is executed. Social engineering is typically
employed to trick a recipient into executing the malicious file. The
best advice with regard to malicious files is to avoid executing them in the first place. The following offers suggestions as to how to avoid them:
Virus Protection at Colby
Protecting yourself from Email-borne Viruses and Other
Malicious Code During Y2K and Beyond
