SIRC32.EXE VIRUS 1

[hchman]

A user at our company had the sirc32.exe virus (W32/sircam@mm). I cleaned the virus but now his applications will not open. It says "Windows cannot find sirc32.exe (the file the virus put on his PC) "This program is needed for opening files of type Application". I went into file types in the folder options and found that for the file type Application it opens with sirc32. How do I change this to open with executables. It will not let me edit or remove this file type. :-(

 

[jgoodman00]

You can set this within the windows registry, but that is by no means a solution to your problem. Using regedit you should be able to correctly set all of the file-type declarations, but I fear to solve your problem properly you will need to install win98 again, & probably as a clean installation. It sounds as though this virus is particularly hostile. James Goodman
j.goodman00@btinternet.com

 

[mcconmw]

You can also use the file type options in Netscape to change the file association via a GUI interface. It does not have the same checks as explorer that prevent you from doing it there.

 

[hchman]

Thanks. I cannot get into regedit because it is an exe file also. I do not have netscape any other ideas?

 

[mcconmw]

Export the .exe file type from an uninfected machine and then move it to the damaged computer and double click it. I had a user once use netscape to change her exe association to media player. I am pretty sure the fix above was how I fixed it.

 

[edfair]

From symantec's help page, copy regedit.exe to regedit.com and open it.
Suggest you look to their writeup on this , as it gives a complete manual method, along with a downloadable clean program that will auto mat the process. Ed Fair
efair@atlnet.com

Any advice I give is my best judgement based on my interpretation of the facts you supply.

Help increase my knowledge by providing some feedback, good or bad, on any advice I have given.

 

[cdogg]

The Sircam virus corrupts the registry in such a way that your best option is to restore from a previous backup.

When you "cleaned the virus" you were simply removing infected files. However, the entries in the registry remain.

For Win98 and Win98SE users:
- restart in MS-DOS mode
- type scanreg and hit enter at the C:> prompt
- choost the "restore" option
- choose a date that is earlier than the time of infection

restart and you should be ok without having to reinstall Windows

also keep in mind that rundll32 was infected by the virus, so you may have to replace it. It is renamed to run32.exe.

 

[reghakr]

hchman,

To restore the EXE association, open Notepad and copy and paste the following between the lines and save the file as exefix.reg. Double-click on the file to merge the contents into the registry. Do it on another computer and transfer via floppy.

=========BEGIN CUT==================
REGEDIT4

[HKEY_CLASSES_ROOT\.exe]
"Content Type"="application/x-msdownload"
@="exefile"

[HKEY_CLASSES_ROOT\.exe\ShellEx]

[HKEY_CLASSES_ROOT\.exe\ShellEx\{00021500-0000-0000-C000-000000000046}]
@="{88C9E8DE-8D28-11D3-8F3C-00A0249EABF4}"

[HKEY_CLASSES_ROOT\exefile]
"EditFlags"=hex:d8,07,00,00
@="Application"

[HKEY_CLASSES_ROOT\exefile\shell]
@=""

[HKEY_CLASSES_ROOT\exefile\shell\open]
@=""
"EditFlags"=hex:00,00,00,00

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\exefile\shellex]

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers]

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\{86F19A00-42A0-1069-A2E9-08002B30309D}]
@=""

[HKEY_CLASSES_ROOT\exefile\DefaultIcon]
@="%1"
============END CUT=================
============================================================
If tha6t diesn;t work,
Copy and paste the following text between the lines into Notepad and save as Fixexe.inf on your desktop. Right-click on the file and choose install. Now shutdown and restart.
==================BEGIN CUT=======================
[Version]
signature=$CHICAGO$

[DefaultInstall]
AddReg=EnableRegandexe

[EnableRegandexe]
HKCR,\.reg,,,"regfile"
HKCR,\regfile,,,"Registration Entries"
HKCR,\regfile\DefaultIcon,,,"C:\WINDOWS\regedit.exe,1"
HKCR,\regfile\shell,,,""
HKCR,\regfile\shell\open,,,"Mer&ge"
HKCR,\regfile\shell\open\command,,,"regedit.exe %1"
HKCR,\regfile\shell\print,,,""
HKCR,\regfile\shell\print\command,,,"C:\WINDOWS\NOTEPAD.EXE /p %1"
HKCR,\regfile\shell\edit,,,"&Edit"
HKCR,\regfile\shell\edit\command,,,"C:\WINDOWS\NOTEPAD.EXE %1"
HKCR,\.exe,,,"exefile"
HKCR,\.exe,"Content Type",,"application/x-msdownload"
HKCR,\exefile,,,"Application"
HKCR,\exefile,EditFlags,1,D8,07,00,00
HKCR,\exefile\shell,,,""
HKCR,\exefile\shell\open,,,""
HKCR,\exefile\shell\open\command,,,""%1" %*"
HKCR,\exefile\DefaultIcon,,,"%1"
====================END CUT=======================
reghakr

 

[paulwood]

If all of the above hasn't resolved the issue, go to

http://www.sarc.com/avcenter/FixSirc.com

to download the removal tool.

 

[hchman]

Thanks everyone. This all started after I ran the removal program. I will try your suggestions beginning with the easiest. I will let you know what happens.

 

[paulwood]

Oops, sorry I mis-understood. You can copy regedit.exe to regedit.com so it runs and change the associations as follows

1) Click START|RUN, type
COMMAND /C COPY %WINDIR%\REGEDIT.EXE %WINDIR%\REGEDIT.COM
and hit ENTER

2) Click START|RUN, type REGEDIT.COM and hit ENTER

3) Remove references to the virus from these keys of the registry

HKCR\exefile\shell\open\command
HKLM\Software\CLASSES\exefileshell\open\command

They should contain only the value (not including brackets)
["%1" %*].

4) Delete the following registry keys:

HKLM\Software\Microsoft\Windows\CurrentVersion\
RunServices\Driver32

HKLM\Software\Sircam

Good luck

 

[hchman]

Thank you all for your suggestions. I used the reg fix given by reghakr and it worked. Thank you reghakr for the effort you put into helping me. I appriciate everyones help.

 

[Kento]

EVERYONE...For future reference, if someone can't run programs due to a virus or trojan, running the EXEfix08.com file at either link will restore the correct .exe info to the registry. Bookmark these sites.

Unzipped files:

http://home.earthlink.net/~rmbox/Reticulated/Only_IE.html

Zipped files:

http://home.earthlink.net/~rmbox/Reticulated/Toys.html

 

[jacuflea]

This virus is tricky. Even though your virus program finds and supposidly cleans you are a still initializing the virus. What you have to do is run the scan in dos mode. This way doesnt open any exe files. Its worked for me.

 

[Chadda]

A very easy way to run regedit when you have this virus is rename regedit.exe to regedit.com. Then run it, works fine!
Alot easier than copying it from another PC.
There's a few registry deletions you have to do, go to

http://www.nai.com

for full 'removal process' instructions.


Peace,
Chadda