Symantec is warning users about a new virus similar to the Magistr strain that was reported on the loose in March. The W32.Sircam worm uses its own SMTP email engine. It offers a variety of subject lines that match the attachment's name and a payload set to trigger on October 16. The payload consists on a number of nasties but the worst impact is probably the one in 20 chance of it deleting all files and directories on the C: drive if the system uses the DD/MM/YY date format, as we do in New Zealand. The US uses MM/DD/YY. There is a lesser chance of the worm filling all remaining space on the hard drive and exporting a random document from the hard drive to the body of the worm before it sends itself on to its next target. Two attachments have been so far notified - SirC32.exe and Tech Specs and Financials.doc.com. A few lines of text will also be included: "I send you this file in order to have your advice" or "I hope you can help me with this file that I send" and the like. The worm uses Microsoft Outlook to email itself on to other targets.
SirCam Worm warning issued
W32.Sircam worm could delete all files in C: drive, copy sensitive documents and generally ruin your day