IT Employment

Ask something
Discussion Locked

Help I've been Hit hard by SirCam

0 helpful
10 replies

by gacema

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Last week my network was hit by the SirCamm worm and I managed to clean
it off the users machines, but one user's mailbox still generates emails and
sends them out. I have even deleted this user's mailbox and NT account,
but still get undetermined messages at the mailsweeper gateway.
Additionally, I reformatted that User's PC to ensure that traces of the virus were dealt with.

Internally, her messages are still going out to the other users.
During the slack period e.g. in the evening, no messages are being generated
from that user, but they appear during the day, which is weird coz the user's
account does not exist !!!!! I am quite baffled by the whole scenario. Any
ideas?

10 replies

by armando.garza

Hello,

Delete all accounts associated with the user.
Scrub their data files again, reformat hard drive, download latest Sircamm eraser, check your mail exhcnage server as well.

Check backup tapes and delete infections there as well. If you think it can resurface, then destroy backup tapes and start fresh.

Good Luck

by guruofdos

Oh boy!! Are you disconnecting (removing the RJ45) from the networks when you 'clean' the machines...

Go to www.symantec.com for a SirCam killer tool and the correct prodcedure for killing this virus on a network.

by guruofdos

See the Symantec web-site for info.....Sircam creates it's 'own' email accounts so killing a user will not solve the problem

by robert

SirCam32 is it's own e-mail client. It will gather the Address Book info from Outlook/Outlook Express and save that into a file called Scam.dll or something similar and then it will get a list of files from My Documents and save that as a file called Scam1.dll or something similar. Then it creates a Key for itself in the Registry and sets up another key in the registry to launch it whenever an EXE file is accessed. The key for that is in:
HKCR\exefile\shell\open\command

The best thing to dois to download the fix from Symantec and follow the instructions to the letter. You will want to run this on EVERY PC in the Enterprise.

If you want to remove this worm/virus manually, they have very good instructions. The registry portion can befacilitated automatically by locating SIRCAM.INF on the internet (be careful). If you need this file, I have this file if you want it. The tools to fix the SirCam, sometimes do not change the registry portion and this .INF file will! It works VERY well.

Email me if you want the file. My alias is my email contact.

by rbhatia

What email application are you using ?
If Outlook, look at the headers and see if you get any additional information from the headers.

by jhoejhit

1. You really need to scan all Mailboxes and Folder of your MS Exchange Server:

a. Remove you connection (RJ45) on your Mail Server (RJ45 to your ISP and RJ45 that is connection to your LAN).
b. You need to stop some distributing services for Exchange Server (MS Exchange Internet Server and MS Exchange Mail Transfer Agent).
c. Update the Scan Virus for Change Server that is installed to your Mail Server.
d. From there you need to scan all Mailboxes and folders on the Exchange Mail Server.

2. Now you’ll need to Update Antivirus Of all Workstation and Scan for Viruses. I advice you to Antivirus Scan all workstations in Safemode with Automatically delete infection files on the Scanning Option.
3. If you have Antivirus Scan for MS Outlook, install it in all Workstations, update it and scan MS Outlook Email for Virus.

This discussion is closed to new replies.