Newsbytes News Network: SirCam Oct. 16 Surprise: A Game Of "Trashin' Roulette"

The SirCam worm celebrates a birthday of sorts next week. On Oct. 16, the persistent e-mail hijacker will be three months old and, to celebrate, it has a surprise for some computer users. However, this surprise will be no party.

Anti-virus software companies say that SirCam, best known for its unauthorized e-mailing of randomly selected documents from the hard drives of infected PCs, also packs instructions that can cause it to delete all files and folders on the "C:" drive of some infected PCs come Oct. 16.

While it is likely that thousands of PCs will be infected by SirCam on Oct. 16, not all of them will see the contents of a hard drive disappear.

Peter Ferrie and Peter Szor, anti-virus researchers with Symantec's Security Response team, analyzed SirCam and wrote that the file-deleting payload only functions on infected PCs configured to use the date format D/M/Y, as opposed to the orderings Y/M/D or M/D/Y.

When SirCam executes on Oct. 16, Ferrie and Szor said, a built-in game of chance offers 20-to-1 odds that it will launch its destructive behavior.

However, the odds aren't as long as they look, since computers infected by SirCam are tricked into launching the worm code - Sirc32.exe - each time any executable file is run.

Cupertino, Calif.-based Symantec said this week that news about high-profile worms such as SirCam, CodeRed and Nimda have caused a doubling in the number of Internet users taking advantage of its free, Web-based virus-scanning and security-check services.

Symantec said that its Security Check site is now seeing some 30,000 visitors a day.

In Edison, N.J., e-mail security outsourcer EasyLink Services Corp. said Thursday that its own scans of the 2 million messages passing through its filters each day showed that there are many PCs still infected by SirCam.

EasyLink said the number of SirCam-infected e-mails dropped 21 percent between August and September tallies, but that there were still 140,103 instances of the worm last month.

The company said it continues to see SirCam infected e-mail at a rate of more than 3,000 a day.

After SirCam, the most common worm spotted in EasyLink customers' e-mail was Magistr in its many variations - one of which has been around since March of this year.

"News headlines about the latest virus do not always reflect the true picture of threats to enterprise networks," said EasyLink's Bill Fallon in a prepared statement. "While we have seen evidence of newer viruses that have attracted significant media attention, such as Nimda, we are finding that SirCam and (Magistr), which have persisted for several months, pose by far the biggest threat to a company's network at the present time."

Symantec has a SirCam-specific worm-removal tool PC users can find at http://securityresponse.symantec.com .

Reported by Newsbytes.com, http://www.newsbytes.com .

15:01 CST

(20011012/Press contact: Heather Haas, Symantec, 310-449-4816 /WIRES ONLINE, LEGAL, BUSINESS/HACKERGEN/PHOTO)