1) Click START|RUN, type
COMMAND /C COPY %WINDIR%\REGEDIT.EXE %WINDIR%\REGEDIT.COM
and hit ENTER
2) Click START | RUN, type regedit.com and hit ENTER
3) Remove references to the virus from this registry key
HKEY_CLASSES_ROOT\exefile\shell\open\command\
It should contain only the value (not including brackets) : ["%1" %*]
4) Delete the following registry keys:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
RunServices\Driver32
HKEY_LOCAL_MACHINE\Software\Sircam
--- File Removal Instructions ---
Failure to complete the Registry Removal Instructions before starting these file removal instructions will result in the in ability to run applications. Do not proceed until the registry has been corrected as mentioned above!
1) Click START | RUN type, command.com and hit ENTER
2) Type, attrib -h c:\recycled\sirc32.exe and hit ENTER
3) Type, del c:\recycled\sirc32.exe and hit ENTER
Win9x/ME users only:
4) Type, attrib -h c:\windows\system\scam32.exe and hit ENTER
5) Type, del c:\windows\system\scam32.exe and hit ENTER
6)Type, move c:\windows\run32.exe c:\windows\rundll32.exe and hit ENTER
If prompted for Overwrite the file, choose (Y)es
If Cannot move ... appears then the virus did not move the Rundll32.exe file.
WinNT/2000 users only:
4) Type, attrib -h c:\winnt\system32\scam32.exe and hit ENTER
5) Type, del c:\winnt\system32\scam32.exe and hit ENTER
6) Type, move c:\winnt\run32.exe c:\winnt\rundll32.exe and hit ENTER
If prompted for Overwrite the file, type Y for (Y)es
If Cannot move ... appears then the virus did not move the Rundll32.exe file.
Win9x/ME/NT/2000 users:
(Note: as the Autoexec.bat file is not modified in all instances, steps 9, 10, and 11 may fail for some users. If this happens, then they were not required.)
7) Type exit and hit ENTER
8) Click START | RUN, type write c:\autoexec.bat and hit ENTER
9) Click EDIT | REPLACE, type @win \recycled\sirc32.exe and click REPLACE ALL
10) Click OK
11) Click FILE | EXIT and choose YES to save your changes
Sircam Virus!!!!!! Help
Problem Solved Thx All!
