It crawls and it’s sneaky. Above all, it wants to distribute your
personal computer files to the world at large. This is one mean worm,
discovered on July 17, 2001. Known as the W32.Sircam.Worm virus, this
malignant pest is spread by way of the Internet. It contains its own SMTP
engine and begins by corrupting and renaming your Rundll32.exe file, used to
open applications. According to the Symantec anti-virus website, the W32.Sircam.Worm was recently upgraded from a level 3
to a level 4 threat.
Consider how many brushes you may have had with this worm.
Over the past month you have probably received an e-mail from an
associate that reads, “Hi! How are you? I send you this file in order to have
your advice.” Whatever the return address on the e-mail, however friendly the
introductory note, don’t open this puppy. The file you are being offered is
contaminated by the evil spawn of the Sircam Worm. Sad to say, the person
whose address is on this e-mail has already fallen prey. The “I send you
this file to have your advice” is the worm’s trick for gaining entry to your
Once this critter gets into your computer it quietly colonizes the
system e-mail. While the machine is logged on to the Internet, the worm
takes files from the “My Documents” folder on your hard drive and sends them
to people whose addresses it manages to find.
In accordance with the laws governing pestiferous things, as described
by Jonathan Swift, this worm has troubles of its own:
Big fleas have little fleas
upon their backs to bite ’em
And little fleas have other fleas
And so ad infinitum.
The [email protected] virus has a worm of its own. To be more
precise, the virus has a bug which prevents it from replicating under Windows
NT or Windows 2000 operating systems. (But don’t be complacent, as this worm
If you happen to become the victim of the W32.Sircam.Worm, there is a
cure. First, if you don’t already have one, get a good anti-virus program
like Norton anti-virus. If the Sircam Worm is discovered on your system you
won’t be able to repair the infected files. It is best to immediately go online and download the [email protected] removal
tool. Disable all active applications, including anti-virus applications
before running the removal tool.
If you’ve deleted or quarantined the virus and find you cannot run
applications, you’ll have to take a detour. As it happens, when you delete
or quarantine the infected files you are effectively disabling your
computer’s Windows applications. You won’t be able to open or run anything
(except DOS programs) because your Runll32.exe file was renamed and infected
by the worm. But don’t worry. Go to another computer and download the
removal tool onto a floppy disc. Then put the floppy into your sick machine and type: a:fixsirc.com (and presto!).
Thanks to our country’s anti-virus heroes, the worm’s days are
numbered and the Internet will soon be safe from the evil spawn that crawls
and distributes private files from the “My Documents” folders of unsuspecting
Best wishes and death to the worm!