Non-VB Virus Help PLEASEEEEE!!!

[Beacon]

One of my work collegues picked up the Sircam or W32/SirCam@MM virus thats going around!!
I cant run any 32 bit apps!!!
Dos and mcafee and explorer is about it?
I've run the latest mcafee scan on it but to no avail!!!

Does anyone know of a way i can get rid this monster?

thanks
beacon

[plenderj]

Copy the rundll.exe and rundll32.exe files from your win98 cab files using the extract utility.
You will have to boot to safe mode command prompt.

Disconnect your machine and every other machine on your network from the network. Disconnecting any routers/proxies would be an idea too.

Then put the files in the attachment onto a blank floppy disk, and run the fixer.bat file on each infected system.
Its a handy little batch file I wrote

The batch file also assumes that the system has its PATH variables okay koz it needs to run attrib and edit.

It will open up autoexec.bat
Go to the bottom of it. The virus usually appends loads of spaces so you mightnt think theres more below the screen. Keep hitting down anyway.
Remove the line "@win \recycled\sirc32.exe"

The batch file will then import a few registry entries to remove the important payload of the virus. It will ignore the other parts which are of no consequence.

There is also a possibility that it might modify the windows\win.ini file. Look at the run= statement. Make sure it does not make reference to sirc or scam.

The PC should book okay then.
Then install the latest dat files for your virus scanner (4149 for mcafee related).

That should do it.
Let me know if you have any problems.

[Beacon]

tahnks jamie!!!
I'm at home but i'll give it a shot tommorrrow!

Yep got 4149!!