W32.SirCam.Worm@mm is a mass-mailing email worm. It arrives in an email with a random subject and an attachment with the same filename as the subject. The body of the message will always start and end with the same two sentences, either in English or Spanish. It is also capable of enumerating network resources and spreading over a LAN.
SirCam is destructive, it has several activation routines, in some circumstances it will attempt to use up all disk space, and there is a 1 in 20 chance that it will delete all files on drive C: on 16 October.
SirCam was first seen on 18 July 2001 and by 20 July it had moved into the top position on MessageLabs' "Viruses stopped today" list. According to Trend Micro's "Worldwide Virus Tracking Center" it was running a close second to W32/Magistr.A on the 20th, but had moved to the top place by the 23rd.
All the anti-virus vendors issued virus definition updates before SirCam became very common, however, as late as 28 July we were receiving incident reports from users who had anti-virus software installed, but had not updated it. Contact us for assistance on automating updates, also consider using our YKScan service, where updates are checked for every 10 minutes - see attached report for a trial offer.