SirCam virus

[BOF]

Just thought I'd let you all know (if you don't already!) that the SirCam virus is on the rounds again. The instances I've received have been headed 'Pirates of Penzance'. Don't know what Gilbert & Sullivan would have made of it!

[LightGuide]

Although it's tapered off a great deal, SirCam seems never to have gone away. Curiously, almost all that we've see here have come from Mexico, Middle and South America, and Spain and Portugal.

[Tibbits]

Had a large one once, something like spicegirls.zip
Anyone know how to decant the original document without firing up the virus?

[Arthur]

Originally posted by Tibbits:
Had a large one once, something like spicegirls.zip
Anyone know how to decant the original document without firing up the virus?

It's probably not called spicegirls.zip, but spicegirls.zip.pif. If you rename the file to spicegirls.zip, you can safely load it into WinZip, Powerarchiver, or whatever you use to open .zip files.

[Tibbits]

Thanks., I deleted it ages ago (was on Yahoo and was clogging things up)

As I understand it, the originial document is encoded into the sircam executable and decoded when run, so that the document appears while the virus installs in the background.

[Arthur]

The virus adds executable code at the front of the file. If you run the infected file the code is executed and the application that's associated with the file is started. But if you rename the file and open it directly in for instance Winzip, the executable code isn't executed, it will be skipped/ignored. Be careful though....

-- Don't try this at home kids!