The SIRCAM is an mass mailing email worm which uses its own SMTP engine to send emails to addresses which it collects from the Windows Address Book into a file in the WINDOWS/SYSTEM subdirectory.

Once activated the worm will copy itself to: C:\RECYCLED\SIRC32.EXE and C:\WINDOWS\SYSTEM\SCAM32.EXE The SIRC32.EXE is registered as a default startup file while SCAM32.EXE is registered as a driver which activates the worm when Windows starts up.

The SIRCAM is dangerous as it will append itself to one of the files in the MY DOCUMENTS subdirectory which it will send out as an attachment to emails.

• Download REMSIRC.REG
• Run REGEDIT from Windows
• Click on IMPORT then click on REMSIRC.REG
• Boot up your computer with a clean DOS diskette from drive A
• Run VBUSTER.EXE from drive A and delete all occurances of the worm

Return Home