Cyprus under siege from latest virus

COMPANIES across Cyprus are being bombarded with the latest e-mail virus sweeping across the globe, but most say anti virus systems are keeping the lethal worm at bay.

The fast-spreading W32.Sircam or Sircam worm spreads itself by sending itself out to all email addresses in a computer’s Microsoft Outlook address book, as well as those stored in the Web browser’s cache files.

The virus not only deletes files on a computer’s hard drive, but picks up random – potentially confidential – files from the computer to send them out by e-mail.

Spidernet’s Marketing Manger, Thois Themistocleous said that although Sircam had not affected them, customers had been calling in for technical support.

“From what customers have been telling me, there has not been any damage. What the virus does is send itself out with files it detects in the My Documents folder on the hard drive to everyone on the computers address book,” he said.

He also said he had received information that media files present on the hard drive could be deleted, but he had not heard of any such cases from his customers.

“Most anti-virus programs have a remedy for Sircam. However, as always when there is a new virus, there are a few hours when it first comes out when it can affect many computers,” he told the Cyprus Mail.

Accounting firm PriceWaterhouseCoopers, along with other companies, managed to escape infection when the anti-virus utilities present on their servers detected the virus before it could be activated.

Sircam infected e-mails can also affect connection speeds for home users because of the attachment sizes and amount of files being downloaded.

According to Symantec’s AntiVirus Research Centre (SARC), several hundred computers and a handful of sites have been infected with the worm.

Besides sending torrents of e-mail, Sircam can perform several destructive acts. If the infected PC uses the European date format (day/month/year), for example, there is a 1-in-20 chance that the worm will delete all files and folders on the hard drive on October 16.

The message body of the infected e-mail will always contain two sentences in either English or Spanish, the first line being “Hi! How are you?” or “Hola, como estas?” and the second line reading “See you later. Thanks” or “Nos vemos pronto, gracias.”

British e-mail screening specialist MessageLabs reported seeing 7,129 copies of the worm as of noon Monday British time.

Although Sircam continues to spread, it appears to be getting stopped before it can do much damage.

To obtain a tool to remove Sircam go to the Symantec website at: www.symantec.com/avcenter/venc/data/[email protected]