Worm:Win32/Sircam.A@mm

Copies itself to network shares as the file <recycle folder>\Sirc32.exe. On the network share, the worm renames <Windows folder>\rundll32.exe (which loads and runs DLLs) to <Windows folder>\run32.exe. The worm then copies itself to <Windows folder>\rundll32.exe. This causes the worm copy to run each time rundll32.exe is called. When the worm copy (rundll32.exe) runs, it then calls the real DLL loader which it renamed to run32.exe.

Sends a copy of itself as an e-mail attachment to e-mail addresses that it finds on the infected computer. The e-mail message body may be in Spanish or English. The attachment contains the worm as well as the content of a file that the worm randomly selects from the list in <system folder>\scd.dll. The attachment may have a double extension, such as xls.lnk. When a user opens the attachment, the worm runs and the additional attachment content (which the worm copied from the file selected from the list in scd.dll) may also run so that the attachment appears to be harmless.