W32/SirCam@MM is a computer virus that appears wide spread as of this writing (I keep receiving it by email several times a day).

As usual, it only infects Windows computers, but annoys Unix users by the way it tries to spread itself: It sends an email with a rather large file attachment to every address it finds in the Windows Address Book and in cached files.

Unfortunately, it uses a different subject every time, so there is no easy way to use a spam filter to prevent the download of the message to the destination system. Thus, even if your system is safe from the virus itself (i.e., you either do not use Windows or know better than to open the attached file), it still affects you by cluttering the Internet bandwidth, and your own email bandwidth.

The body if the email starts with:

Hi! How are you?

It then continues with one of the following:

  • I send you this file in order to have your advice

  • I hope you can help me with this file that I send

  • I hope you like the file that I sendo you

  • This is the file with the information that you ask for

Optionally, it may end with:

See you later. Thanks

Occasionally, the whole text is in Spanish.

The email then continues with a file attachment using a dual extension, e.g. somefile.doc.lnk, again, something quite typical among recent viruses and an immediate tipoff. Alas, enough people do not seem to see the obvious, click on it, get their system infected and keep sending these huge files to everyone in their Windows Address Book.

The virus itself is extremely aggressive in that it modifies an entry in the Windows Registry. As a result, every time any executable file is run, Windows will also load and run the virus.

Hence, this virus does not infect just an individual executable as the past viruses have done, it infects Windows. Savvy computer users have been long saying that Windows is a virus. As of now, in many cases this adage is no longer a smirk remark but the literal truth.

If you need more information, see www.mcafee.com/anti-virus/viruses/sircam/ for detailed instructions how to remove the virus. You may want to send that URL to any friend who emails you the virus (along with a note saying, See, I told you to switch to Unix!).