http://securityresponse.symantec.com/avcenter/venc1. It creates copies of itself as %TEMP%\\<File name> and C:\\Recycled\\<file name>, which contain the attached document. This document is then run using the program registered to handle the specific file type. For example, if it is saved as a file with the .doc extension, it will run using Microsoft Word or Wordpad. A file with the .xls extension will open in Excel, and one with the .zip extension will open in your default zip program, such as WinZip.
NOTE: The term %TEMP% is the Temp variable, and means that the worm will save itself to the Windows Temp folder, whatever its location. The default is C:\\Windows\\Temp.
2. It copies itself to C:\\Recycled\\Sirc32.exe and %System%\\Scam32.exe.
NOTE: %System% is also a variable. The worm will locate the \\System folder (by default this is C:\\Windows\\System) and copy itself to that location.
3. It adds the value
Driver32=%System%\\scam32.exe
to the following registry key:
HKEY_LOCAL_MACHINE\\SOFTWARE\\
Microsoft\\Windows\\CurrentVersion\\RunServices
4. It creates the following registry key:
HKEY_LOCAL_MACHINE\\Software\\SirCam
with the following values:
FB1B - Stores the file name of the worm as stored in the Recycled directory.
FB1BA - Stores the SMTP IP address.
FB1BB - Stores the email address of the sender.
FC0 - Stores the number of times the worm has executed.
FC1 - Stores what appears to be the version number of the worm.
FD1 - Stores the file name of worm that has been executed, without the suffix.
FD3 - Stores a value corresponding to the current state of the worm.
FD7 - Stores the number of mails that have been sent prior to any interruption of this process.
5. The (Default) value of the registry key
HKEY_CLASSES_ROOT\\exefile\\shell\\open\\command
is set to
C:\\recycled\\sirc32.exe \"%1\" %*\"
This enables the worm to execute itself any time that an .exe file is run.
6. The worm is network aware, and it will enumerate the network resources to infect shared systems. If any are found, it will do the following:
Attempt to copy itself to <Computer>\\Recycled\\Sirc32.exe
Add the line \"@win \\recycled\\sirc32.exe\" to the file <Computer>\\Autoexec.bat
Copy <Computer>\\Windows\\Rundll32.exe to <Computer>\\Windows\\Run32.exe
Replace <Computer>\\Windows\\rundll32.exe with C:\\Recycled\\Sirc32.exe
7. There is a 1 in 33 chance that the following actions will occur:
The worm copies itself from C:\\Recycled\\Sirc32.exe to %Windows%\\Scmx32.exe
The worm copies itself as \"Microsoft Internet Office.exe\" to the folder referred to by the registry key:
HKEY_CURRENT_USER\\Software\\Microsoft\\
Windows\\CurrentVersion\\Explorer\\
Shell Folders\\Startup
8. There is a 1 in 20 chance that on October 16th of any year, the worm will recursively delete all files and folders on the C drive.
This payload functions only on computers which use the date format D/M/Y (as opposed to M/D/Y or similar formats).
Additionally, the payload will always activate immediately, regardless of date and date format, if the file attached to the worm contains the sequence \"FA2\" without the letters \"sc\" following immediately.
NOTE: Due to a bug in the initialization of a random number generator, it is highly unlikely that the file deleting, and space filling payloads of this threat will ever be activated.
9. If this payload activates, the file C:\\Recycled\\Sircam.sys is created and filled with text until there is no remaining disk space. The text is one of two strings:
[SirCam_2rp_Ein_NoC_Rma_CuiTzeO_MicH_MeX]
or
[SirCam Version 1.0 Copyright ¬ 2000 2rP Made in / Hecho en - Cuitzeo, Michoacan Mexico]
10. The worm contains its own SMTP engine which is used for the email routine. It obtains email addresses through two different methods:
It searches the folders that are referred to by the registry keys
HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Cache
and
HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Personal
for sho*., get*., hot*., *.htm files, and copies email addresses from there into the file %system%\\sc?1.dll
where ? is a different letter for each location, as follows:
scy1.dll: addresses from %cache%\\sho*., hot*., get*.
sch1.dll: addresses from %personal%\\sho*., hot*., get*.
sci1.dll: addresses from %cache%\\*.htm
sct1.dll: addresses from %personal%\\*.htm
It searches %system% and all subfolders for *.wab (all Windows Address Books) and copies addresses from there into %system%\\scw1.dll.
11. It searches the folders referred to by the registry keys:
HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Personal
and
HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Desktop
for files of type .doc, .xls, and .zip, and stores the filenames in %system%\\scd.dll. One of these files will be appended to the worm\'s original executable and this new file will be sent as the email attachment.
The From: email address and mail server are taken from the registry. If no email account exists, then the current user name will be prepended to \"prodigy.net.mx\", eg if the current user logged on as JSmith, then the address will be \"jsmith@prodigy.net.mx\". Then the worm will attempt to connect to a mail server. This will be either the mail server taken from the registry, or one of
prodigy.net.mx
goeke.net
enlace.net
dobleclick.com.mx
The language used for the mail depends on the language used by the sender. If the sender uses Spanish, then the mail will be in Spanish, otherwise it will be in English. The attachment is chosen randomly from the list of files in the scd.dll.
Ny bruger
Nybegynder
Opret
Preview
