MD

News

Saturday, May 26, 2012

Advertise with us »

''U'' experts respond to SirCam outbreak

BY MARIA SPROW
Daily News Editor
Published July 29, 2001

Officials first discovered the enemy July 17. The following day, University officials took cautious measures to ensure students, faculty and staff would be prepared for what was to come.

The enemy a computer virus known as the SirCam worm and considered destructive with a medium risk by the World Virus Tracking Center has since become a wide-spread computer virus in the nation, according to the WTC. Since its discovery, the virus has infected more than 27,000 computers in North America, and more than 50,200 computers worldwide.

SirCam is a Trojan virus that only affects IBM compatible computers and looks harmless to its victims. It spreads after a victim opens an attachment to an e-mail. The virus automatically looks at an individual"s address books and addresses from internet caches and sends short, friendly e-mail letters to the addresses. It also goes into the victim"s "My Documents" folder and randomly picks out a file to send along with the e-mail. The document is then attached to the e-mail and the virus.

The major problems from the virus started a week after it was discovered. Due to several preventative measurements, the worm has only created a nuisance among the University community.

"It didn"t become a big problem until the 23rd, and that big problem is not in the University, it is out in the world," said University Team Leader for Data Recovery and Virus Control Bruce Burrell. "We"ve seen (SirCam) coming into the University. We have seen some infections but in the grand scheme of things, we"ve only seen a few. I might need more than my fingers to count them."

Since it was discovered, the University has sent out emergency announcements on the Telnet login screen and has updated its virus-scan program to destroy the worm.

Besides sending out private documents, the virus could cause documents and files to be destroyed. Anti-virus officials determined that the virus is timed to hit some PC computers with European day/month/year settings on October 16.

Nationally, the Wall Street Journal Online reported the virus spread private FBI documents to outsiders Tuesday.

The FBI reported that the information sent out was not sensitive or classified.

It is still unknown where the virus originated from or why it was created, but rumors and theories are running amuck.

"There are 58,000 viruses in the world and probably 58,000 reasons for the viruses," Burrell said. "It"s entirely possible that the person who wrote it didn"t want it to spread. But typically viruses don"t get to choose when they succeed and when they don"t. They have to get lucky. This one got lucky."

There is also evidence that the virus came from Mexico or another Spanish-speaking country. There is a version of SirCam circulating in Spanish, and if the virus is unable to find the victim"s e-mail address, it will send itself out from several different Mexican addresses, such as prodigy.net.mx.

Burrell said he agreed the creator of the virus is probably not English. "The language in English is a little bit clunky so one would guess that it"s not a native English speaker," he said.

Burrell said the best way to avoid receiving the virus is to be cautious.

"Never open unsolicited attachments, not even when they come from people you know and trust," he said. "Unless that person who sent it is one of the world"s top virus experts, it could be infected."

Although awareness of the virus is spreading, Internet users should not expect it to go away any time soon.

"I think it"s going to be around for a fairly good while," Burrell said, "but the virus has some things about it that mean it will be easy to trace where it"s coming from who the victims are. It"s someone who probably doesn"t realize or someone who"se frantically trying to get rid of it."

Students whose compuuters are infected with the virus should visit the University"s SirCam website at www.umich.edu/virus-busters/sircam.html.


|