is the mass-mailing worm originated probably in Mexico. It is written in Delphi and is about 134 kB long. It is able to sends itself together with randomly selected local file to all users found in the Windows Address Book and email addresses in temporary Internet cached files.
It arrives via an email message containing the following information:
Subject: [random filename]
I send you this file in order to have your advice or
See you later. Thanks
If the local language is set to Spanish, the same message is sent out in Spanish.
Infected message contains an attachment with a double extension, the
first extension will be the same as the file appended behind the virus
has. Second extension (hidden by default) is the executable one (EXE,
The worm itself is on the beginning of the attachment with the additional
random file on the end. When executed, the worm saves itself into the C:\RECYCLED
directory and then restores the original of the additional file. It is
able to execute it (in case of EXE) or open it with associated
application to hide its presence in the system. Worm then copies itself
to the C:\RECYCLED\SirC32.exe file. It changes the registry in
order to be executed whenever EXE files are run (similar to Win32:PrettyPark):
Worm also creates a copy of itself to the C:\Windows\System
directory under the name SCam32.exe and adds the registry key
value in order to load itself automatically:
Win32:Sircam then creates a list of GIF, JPG, JPEG, MPEG, MOV, MPG, PDF, PNG, PS, andZIP files found in the My Documents folder and saves it to the file SCD.DLL in the system directory. It also gathers all email addresses from the above mentioned resources and saves them to the file SCD1.DLL in the system directory.
The worm attaches a copy of the file mentioned in the SCD.DLL file to its end and sends such file to all email addressed found. It uses its own SMTP routine to do this. Worm is also able to spread in the Local Area Network via shared disks.
The worm also creates an additional registry key used to store some
variables for itself: