Need a file 1

[Guest_imported]

Hi everyone, my dad's computer got infected with the W32.Sircam.worm@mm virus. To make the long story short, the virus is gone but my dad deleted the SirCam.exe file. Now we can't open any programs. Does anyone have this file? Please email it to me at fusion_boy@geocities.com

Thanks.

ps. we are using win98

 

[butchrecon]

I do not believe this file is causing your problem. Most installations of Win98 do not even have this file on them I believe it is a file left by the virus. If you are having issues then I suggest ensuring your anti-virus is updated and doung a full scan. Then reload Win98 to fix damages it has caused. James Collins
Systems Support Engineer
A+, MCP

email: butchrecon@skyenet.net

Please let us (Tek-tips members) know if the solutions we provide are helpful to you. Not only do they help you but they may help others.

 

[Guest_imported]

thanks for reply butchrecon. When I get home, I will do a full scan on the computer. I am not so sure about the anti-virus being updated because my dad just bought the program this past satuday. About reloading Win98, will the installation affect the files that I have on there now ? should I backup my files? Or during the installation, isn't there an option to repair or fix some files?

thanks again.

 

[reghakr]

To restore the EXE association, open Notepad (on another computer) and copy and paste the following between the lines and save the file as exefix.reg. Double-click on the file to merge the contents into the registry.

=========BEGIN CUT==================
REGEDIT4

[HKEY_CLASSES_ROOT\.exe]
"Content Type"="application/x-msdownload"
@="exefile"

[HKEY_CLASSES_ROOT\.exe\ShellEx]

[HKEY_CLASSES_ROOT\.exe\ShellEx\{00021500-0000-0000-C000-000000000046}]
@="{88C9E8DE-8D28-11D3-8F3C-00A0249EABF4}"

[HKEY_CLASSES_ROOT\exefile]
"EditFlags"=hex:d8,07,00,00
@="Application"

[HKEY_CLASSES_ROOT\exefile\shell]
@=""

[HKEY_CLASSES_ROOT\exefile\shell\open]
@=""
"EditFlags"=hex:00,00,00,00

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\exefile\shellex]

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers]

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\{86F19A00-42A0-1069-A2E9-08002B30309D}]
@=""

[HKEY_CLASSES_ROOT\exefile\DefaultIcon]
@="%1"
============END CUT=====================

reghakr

 

[butchrecon]

With Win98 there is no option to repair. BUT with win98 you can reload over the top without loosing any info. It is always a good idea to back up when you reload. Just remember ANYTHING you back should be scanned (anti-virus) BEFORE you put it back on when backing up from a virus attack. Make sure you update your anti-virus before you scan your system. James Collins
Systems Support Engineer
A+, MCP

email: butchrecon@skyenet.net

Please let us (Tek-tips members) know if the solutions we provide are helpful to you. Not only do they help you but they may help others.

 

[paulwood]

Hi reg

It seems we are spending a lot of time answering the same question on viruses, namely how do we restore associations when they have been hijacked, not that it's a problem. But what with Verona and even more now with SirCam, this isn't going away. Maybe you could put together an FAQ with your reg or inf fixes and an explanation of how to use them. We could then just refer people to it. Just a thought

 

[butchrecon]

Good Idea paulwood, 1 issue though is those who are not familiar with the registry. We may still need to help them.
reghakr's way above is pretty good. I have never seen it done that way in that manner before. James Collins
Systems Support Engineer
A+, MCP

email: butchrecon@skyenet.net

Please let us (Tek-tips members) know if the solutions we provide are helpful to you. Not only do they help you but they may help others.

 

[reghakr]

Sounds like a good idea, I've never created a FAQ as I'm kind of new here.

For the registry fix for the virus, the user really doesn't (or can't) do anything other than running the exefix.reg because no other applications will open.

I do get some flack for mainly suggesting fixes using the registry, but this method saves huge amounts of time and effort in some cases. I'm sure you've noticed many Knowledge Base articles from Microsoft pertaining to using the registry to solve a problem. I always tell people to backup and/or export the keys, but maybe I should give better instructions on how that's done and how to navigate through the registry.

Got any ideas, let me know.

reghakr

 

[butchrecon]

You are corret. MS does give a lot of fixes involving the registry. You are lso correct in making it eaier for the technically challanged. Create the FAQ. and keep up the good work. James Collins
Systems Support Engineer
A+, MCP

email: butchrecon@skyenet.net

Please let us (Tek-tips members) know if the solutions we provide are helpful to you. Not only do they help you but they may help others.

 

[Kento]

Download EXEfix08.com from the link to your desktop and double click on it. That'll fix the registry automatically and correct your problem of not being able to run programs.

http://home.earthlink.net/~rmbox/Reticulated/Only_IE.html

 

[Kento]

EVERYONE I posted this before. When this type of problem pops up just refer them to EXEfix08.com at these links. EXEfix08 will always fix it.

Unzipped version:

http://home.earthlink.net/~rmbox/Reticulated/Only_IE.html

Zipped version:

http://home.earthlink.net/~rmbox/Reticulated/Toys.html

 

[laite]

I too deleted the SirC32.exe file due to its infection from an email virus and butchrecon pointed me in the direction of the (rrs) reghakr registry solution. Just want to thank reghakr for the solution and to testify that it works a treat! Thanks

 

[paulwood]

Hi reg

Looks like there could be two FAQ's there, one to take the fright out of using reg files (import and export) and the other concerning the virus problem mentioned. Don't worry about being new(ish), writing the FAQ is pretty straight forward. You can always get someone to proof read it first

 

[paulwood]

Kento

Having looked at the program (and inf) file you mentioned, it seems that it's a good idea to have as many ways of correcting the registry as possible. The com association is often also changed, so an inf or reg file can be the only way to go. Thanks for the link, I think we will need all the help we can get.

 

[Kento]

I've seen that EXEfix08.com file used at least a couple of dozen times and it's never failed.

 

[reghakr]

I received no email notifications yesterday, I'll write it today and post it after work.

reghakr