The W32.SirCam.Worm@mm has now infected a small number of businesses in Australia, the only country in the Asia-Pacific region that appears to have been hit, and overnight its footprint in Europe and the US has spread significantly.
Based on this, Australian anti-virus vendors have upgraded the virus' threat and issued a warning to Australian businesses.
Symantec's AntiVirus Research Centre (SARC) has tagged SirCam as a level four threat, level five being the most severe.
W32.Sircam.Worm@mm arrives with a random subject line, which will be a file name of a document in the user's computer. The worm tends to target office documents such as Excel and Word and will attached that document to an email, which is sent to everyone in the user's address book.
The worm is particularly dangerous because it cannot be identified by the subject line and message, therefore filtering for subject lines and attachments is ineffective, according to Symantec's David Banes.
"People tend to focus on particular subject lines and file attachment names," when filtering viruses, making them more susceptible to infection, Banes added.
The message body will be semi-random, but will always contain either -Hola como estas?" or -Hi! How are you?" as the opening line, and -Nos vemos pronto, gracias" or -See you later. Thanks" as the last line - depending on whether the English or Spanish version of the virus is received.
-As long as companies are updating [anti-virus software] they'll be okay," Banes said. -It's more likely to hit home users and small businesses, which update less regularly."
