While this virus doesn't directly effect Mac Users it certainly indirectly does. All your PC idiot friends send you mail with big attachments saying something like:
Hi! How are you?
I send you this file in order to have your advice
See you later. Thanks
Of course the big attachment is a windows executable worm that sends mail out to all of your OutLook address book.
THIS CANNOT INFECT YOUR MAC. It can infect your Virtual PC program if you have it on your Mac and you execute the attachment.
I think the worst part of it is simply clogging up the mail servers with all the garbage on the Mac side. Make sure you discard your attachments from the system once you are finished with them.
I pulled these notes off MacFixit.
SirCam virus and the Mac: a follow-up
Yesterday, we reported that SirCam virus/worm could indirectly affect Mac users by flooding a mailbox with mail sent from PC users infected with the virus. We received several reader replies on this matter:
It gets worse Gedeon Maheux (of The Iconfactory) writes: "According to Symantec, Sircam not only gets its emails from people's address books, but also from the cache files of web pages stored on the infected computers. This further increases the odds of getting infected email. Like MacFixIt, The Iconfactory is getting just slammed by this."
SirCam and confidential documents Another MacFixIt reader found: "This virus explains why starting yesterday I began receiving emails from a business competitor of mine. There are attachments to the emails that contain business correspondence of my competitor computer. This correspondence contains price quotes, customer names and addresses etc.! [To read the files, I had to decode the attachment using YA-Decoder. I then could open the decoded attachment in Virtual PC 4, using WordPad, on a disk image especially created to open unknown files.]"
SirCam and Virtual PC Frank Hatcher cautions that the virus can affect Mac users if they run Virtual PC or other PC emulator software. He writes: "My wife got the worm via an email from a friend as a xls attachment. When she tried to open it a message popped up that said the file was a windows application file. So she opened our Virtual PC program and tried to open it there. Well it attached itself to the SirC32.exe application and essentially made the VPC drives unusable. I had to trash the whole VPC folder. During the contamination she noticed that the windows OE program started up. My guess is that the worm was trying to send out email - fortunately we only use the Mac OE and had no addresses in the windows version."
Although some users have claimed that the virus can directly corrupt files on a Mac, Symantec contends (and we concur) that this is not possible.
Bob Nunn - Operator Headgap Systems, Inc. E-mail: headgap@headgap.com
