Worm Virus is Killing me

[pike]

Did a forum search for info on this virus: <font color=red>W32.Sircam.Worm@mm</font color=red>
No results.
This is what happened:
Win98SE
Norton AntiVirus
Ok, i knew i had a virus and my outdated definitions were not helping. I updated and Norton found 4 infected files
- C:\RECYCLED\SirC32.exe
- C:\RECYCLED\SETUPEX.EXE
- C:\RECYCLED\V08B5155.EXE
- C:\WINDOWS\SYSTEM\SCam32.exe
Norton only game me the "delete" option, and that is what i did.
Also in a specific scan of C:\WINDOWS\SYSTEM, Norton found this virus: W32.Navidad and
C:\WINDOWS\SYSTEM\winsyrc.vxd was infected with only "delete" as option, so i deleted.
Now, when i click an apps in Windows i get this message:
"impossible to find SirC32.exe"
"This program is needed to open files of type: application"
Then it has a box for "Location" in order to locate that missing file.
- SCam32.exe
- winsyrc.vxd
These two files are not on my sys and neither on my second Win98SE sys and no lan here.
WTF is going on here?
Is my best option too do a "reinstall of Win98" from DOS, this i found too be possible to do, but will only sys files be reinstalled as Win 95 does when same procedure is done?

Any and all advice will be greatly appreciated.

Danny


Are we really ready for "contact" ?

 

[Zlash]

Thier on your CD, but 98 is trash in this area and most the time when it asks you for the disk it can't find the file because they are all in CAB files.

You can either go through the cab files on your CD and restore the file or you can use an extract program to search the CD i think.

Personally i've gotten sick of dealing with that so i made a cd with all the cab files already extracted that has all the .dll's and .vxd's etc.

...

 

[pike]

What i don't quite catch, is wy in my 2nd Win98 sys neither of these:
-SCam32.exe
-SirC32.exe
are present?
I beleive i will be going for the reinstall over present config. Serves me right for not having a proper backup strategy. Your idea of decompressed cab folders seems a good one.
See ya

Are we really ready for "contact" ?

 

[Flyboy]

I would be happy to send these files to you if you would rather try that. I'm also running Win98 SE. Let me know...

Oops...sorry I misread your message. Your right. These files are not available in Win98 SE.<P ID="edit"><FONT SIZE=-1><EM>Edited by Flyboy on 02/09/02 05:40 PM.</EM></FONT></P>

 

[Flyboy]

AHHHHH! I see. It appears the SirC32.exe program IS the virus NOT a Windows infected application!!! Looks like you just need to fix the Windows registry. Here's the LINK:

<A HREF="http://www.antivirusebook.com/database/tmp/sircamvirusremoval2.html" target="_new">http://www.antivirusebook.com/database/tmp/sircamvirusremoval2.html</A>

You should look into the other files too. May be a better solution than starting all over with a reinstall.

 

[CALV]

try here for info http://securityresponse.symantec.com/avcenter/venc/data/w32.sircam.worm@mm.html



If they squeeze olives to get olive oil, how do they get baby oil?

 

[pike]

YES!
That link with it's self executing virus removal utility did that sucker in and u where right on target. Bravo!

And a <b>BIG THANK'S</b>

Danny

Are we really ready for "contact" ?

 

[Zoron]

Whenever you have a virus that either Norton can't repair / delete or if deleting files causes a problem, always check out the antivirus research center.

http://www.sarc.com

Chances are if NAV picks up the virus, you'll find info about it on that site. It'll tell you what the virus does and how to remove it manually if NAV screws up.

<font color=red> If you design software that is fool-proof, only a fool will want to use it. </font color=red>

 

[Flyboy]

Great! Glad to hear you got it squared away! So did you manage to remove the other viruses?

 

[pike]

Gosh, so glad to get that worm out fotgot about : W32.Navidad virus. I`m at work presently, can`t check, but did do a`"complete" NAV scan of sys (31k+ files) with nothing to report. Guess the delete function was enough for :
W32.Navidad virus but will recheck.
Sincere thanks to all for links and info

Danny

Are we really ready for "contact" ?