Page One

Campus Computing News

Renew PRAS Accounts Now

SirCam Virus, Others Continue to Plague UNT and the World

The SmartForce Server is on Course!

Lab-of-the-Month: SCDGAL

Computer Purchase Information Now Online

ACS Summer News

Migrating Queries from Microsoft Access to an Access Project

Today's Cartoon

RSS Matters

SAS Corner

The Network Connection

List of the Month

WWW@UNT.EDU

Short Courses

IRC News

Staff Activities

    

SirCam Virus, Others Continue to Plague UNT and the World

By Claudia Lynch, Benchmarks Online Editor

In case you haven't noticed, computer viruses of various sorts continue to plague the world. According to the UNT Anti-Virus Website, http://cwn.unt.edu/virus/ , the "911" alerts this week are for the Code Red Worm (not generally a problem for individual PCs, only "unpatched administrator's Microsoft IIS severs") and the SirCam Virus. SirCam is a nasty mass-mailing virus that attempts to send itself and local documents to all users found in the Windows Address Book and email addresses found in temporary Internet cached files (web browser cache). It might delete files on 16 October and/or fill up hard disk space by adding text entries over & over again to a SirCam recycle bin file.

There is a program on the UNT Anti-Virus Website that will remove SirCam if your computer is infected.

Unfortunately, right now, according to Mike Williams, UNT Anti-Virus Coordinator, McAfee has a problem detecting the SirCam (W32/SirCam@MM) virus before the machine is infected. The problem. is that McAfee VirusScan 4.5 does not include scanning for the .pif or the .lnk extension by default. Even if you have applied SP1 to McAfee it does not scan for these extensions. A person was recently sent the SirCam virus with a .doc.pif extension and when it was double clicked the virus infected the machine.

The current fix for this, according to Williams, can be done two ways:

  1. Right click Vshield in the system tray and select PROPERTIES>SYSTEM SCAN in the "What to Scan" options select the "All files" option. This could slow performance on your system if you do a lot of file manipulation. This option will assure that users are not caught off guard by other extensions that are not currently in the list.
  2. Right click Vshield in the system tray and select PROPERTIES>SYSTEM SCAN in the "What to Scan" options select the Extensions button. Check to make sure that pif and lnk extensions are not listed in the "Program file extensions" window. Then click the add button and add the pif and lnk extensions to the list. This option should not slow the performance of your computer however other extensions may need to be added to the list in the future.

Future versions of McAfee will have the extensions pif and lnk already entered into the list however version 4.5.1 is still currently being tested here at UNT. UNT Computing Center staff are also looking at ways to automate the changes to McAfee.

How do I get help with Virus Protection?

Here at UNT the Network Managers are generally responsible for keeping the people in their departments informed about such things, but if you're unsure about the status of such software on your computer, you probably ought to contact your Network Manager and ask. If you're not sure who your Network Manager is, check here http://www.unt.edu/helpdesk/netman.htm.

UNT's Anti-Virus Website ( http://cwn.unt.edu/virus/ ), mentioned above, is accessible to anyone on campus or who comes into campus via the UNT dial-up lines. If you satisfy those requirements, the anti-viral software is available to you from there free-of-charge.Once you have the software it is wise to set it to run every time your computer is re-started (you can always cancel it if you have to re-start several times). You should also set it to automatically update.