SirCam messed up my dad's computer...please help

[dmw16]

My dad got infected with SirCam and he ran Norton 2k2 to get rid of it, and Norton got rid of his SirC32.exe file, and now he cant run any executables in Win98. How can he replace this SirC32.exe file? I cant find it on any of my machines. Is it in one of the compressed files on the Win98 CD? If it is, which one?
thanks,
-doug

 

[viguru]

Cant you just do a dirty install over top of his current installation?

 

[Kanly]

Sounds like Norton did an incomplete removal job and left some registry entries in that should be removed.

This just happened to a friend of mine.

Dowload and run the Removal Tool

and you should be good to go.

 

[dmw16]

I could do that. But I'd have to mail a CD to him, all he has is a restore CD. Does anyone know where on the Win98 CD that file is?
thanks,
-doug

 

[Salvador]

The restore cd works just like a full cd only that the restore cd is locked to your dad's computer. He shouldn't have any problems reinstalling Windows over the top of the current version. I experimented with this. I have a Dell and wiped the hdd clean (fdisked and formatted). I tried to use the restore cd on another computer to see if it would install and it wouldn't let me, but when I tried the restore cd in the computer that the cd was meant for, the restore cd installed the complete OS, even on a different hdd in the original computer. This tells me that the restore cd is locked to the BIOS or something. I don't know for sure, but this makes sense to me.

I'd run the virus removal tool first though to make sure that the Sircam files are gone. It might even return your dad's computer back to normal.

Sal

 

[Psychoholic]

The link DukeLeto gave you should take care of things. If you or him is having trouble doing this I wouldn't hesitate to reinstall to make sure all traces are gone, better safe than sorry.

Once this is fixed remind him the importance of keeping virus definitions up to date. If necessary use the task scheduler to remind him every few weeks.

 

[Kanly]

SirC32.exe is the virus file.

His registry is still pointing to it as the default program to run .exe files. This is wrong.

The same exact thing happened to a friend of mine last week.

He needs to dowload that tool and run it.

If I remember right, it is a .com extension so windows will not look for SirC32.exe to run the file.

 

[sohcrates]

if the virus has been removed, then he needs to re-associate .exe's with "exefile"

you can do it through regedit

go down to hkey_classes_root, navigate to .exe extension, then make sure it's associated with "exefile"

you may need to rename regedit to regedit.com to get it to run

 

[Kanly]

The problem lies in old Norton AV definitions.

It recognizes SirCam32.exe as a virus file, but it doesn't restore the correct registry entries.

So, it removes the .exe file but leaves the registry entries pointing to SirCam32.exe.

Thus you can't get any .exe file to run.

The removal tool cleans everything up with no problems.

And it's probably easier for Dad to run the removal tool than edit the registry himself.