Virus Encyclopedia

Welcome to the Virus Encyclopedia of Panda Security.


Threat LevelHigh threat
DistributionNot widespread
Common name:Sircam
Technical name:W32/Sircam
Threat level:Medium
Alias:W32/Sircam@mm,, I-worm.Sircam, Troj_Sircam.A, W32.Sircam.Worm@mm, W32/SirCam.dat
Subtype: Trojan
Effects:  It steals data on the infected user, deletes folders and uses up the free hard disk space.

Affected platforms:

Windows XP/2000/NT/ME/98/95

First detected on:
Detection updated on:June 16, 2009
Proactive protection:
Yes, using TruPrevent Technologies

Brief Description 


Sircam is a worm that gets into computers in an e-mail message with the first line Hi! how are you ?

Sircam is highly contagious and spreads very rapidly:

  • By automatically sending itself to all the contacts in the Address Book in infected computers.
  • By infecting all the Windows NT workstations in a network. This makes this virus particularly dangerous for companies.

It main effects are: it steals personal data on the users it infects, uses up the free hard disk space and deletes the information it contains.

Visible Symptoms 


Sircam reaches computers in an e-mail message that is very easy to recognize, as it always has the following characteristics:

  • Message: The first line is:

    Hi! how are you ?

    This line is followed by the text:

    I send you this file in order to have your advice

    I hope you can help me with this file that I send

    I hope you like the file that I sendo you

    This is the file with the information that you ask for

    And the last line is:

    See you later. Thanks.
  • Attachments: The attachment has a variable name and a double extension (for example, PICTURE.VBS.JPG).

For more information consult the section Means of transmission.