New W32.Sircam.worm is loose and trickier then Code Red worm
W32.Sircam.Worm@mm arrives with a random subject line, which will be a file name of a document in the users computer. The worm tends to target office documents such as Excel and Word and will attached that document to an email, which is sent to everyone in the user's address book.
The worm is particularly dangerous because it cannot be identified by the subject line and message, therefore filtering for subject lines and attachments is ineffective, according to Symantec's David Banes.
The message body will be semi-random, but will always contain either "Hola como estas?" or "Hi! How are you?" as the opening line, and "Nos vemos pronto, gracias" or "See you later. Thanks" as the last line depending on whether the English or Spanish version of the virus is received.
Random virus hits on Australia
By Rachel Lebihan, ZDNet Australia
The recent SirCam virus that has been keeping computer users on their toes by cropping up in Inboxes with different subject lines and file attachment names, has honed in on Australian businesses.
The W32.SirCam.Worm@mm has now infected a small number of businesses in Australia, the only country in the Asia-Pacific region that appears to have been hit, and overnight its footprint in Europe and the US has spread significantly.
Based on this, Australian anti-virus vendors have upgraded the virus? threat and issued a warning to Australian businesses.
Symantec?s AntiVirus Research Centre (SARC) has tagged SirCam as a level four threat, level five being the most severe.
?People tend to focus on particular subject lines and file attachment names,? when filtering viruses, making them more susceptible to infection, Banes added.
"As long as companies are updating [anti-virus software] they?ll be okay,? Banes said. ?It?s more likely to hit home users and small businesses, which update less regularly."
