Sophos

Talk to our experts

Find your local press contact

Resources

Info feeds

What are info feeds?

23 July 2001

Sircam - are you protected?

Sophos technical support is reporting a significant number of calls from customers affected by the W32/Sircam-A worm.

"This worm is particularly damaging for businesses because of its ability to leak confidential information. The worm is capable of "scooping up" documents and spreadsheets from your hard drive and forwarding them to everyone in your address book," said Graham Cluley, senior technology consultant for Sophos Anti-Virus. "The message is simple - keep your anti-virus software up to date and be wary of all unsolicited attachments. If you don't need it or aren't expecting it, don't launch or open it."

The Sircam worm, unlike many other email-aware viruses, uses its own SMTP routine and so does not rely on Microsoft Outlook to spread itself via email. It can also spread via open network shares.

Sophos issued an IDE update to protect against W32/Sircam-A on 18 July 2001. Sophos recommends users subscribe to its free notification service regarding new viruses found in the wild.

Please note: Because the virus can spread itself using the .EXE, .COM, .LNK, .PIF and .BAT file extensions Sophos technical support recommend users add LNK and BAT to the list of executable file extensions which Sophos Anti-Virus scans.

Instructions on how to do this are here.

Please also read the Instructions for disinfecting W32/Sircam-A.


See also: