TROJ SIRCAM.1 - SirC32.exe

Question

TROJ SIRCAM.1 - SirC32.exe

Xtian (IS/IT--Management)

(OP)

22 Jul 01 07:28

Hi,

I got infected this morning by TROJ SIRCAM.A

I didn't have the last pattern files uptodate

After I got the last updated files, Norton Anti-Virus detected that SirC32.exe and SCam32.exe were infected. I chose to repair and delete them.

Unfortunately, as SirC32.exe is missing I can't run others application than IE.

Anyone running WINDOWS 98 (2nd Edition) could send to me these 2 files ( SirC32.exe and Scam32.exe) to clegall2000@yahoo.com ?

Thanks in advance,
Christian,

epohl (MIS) · Answer 1 · 2001-07-23 11:07:13

Xtian,

These were actual virus files and should not be required to run anything. You choose correctly when you choose to delete them. However they are still being referenced by your autoexec.bat and registry. Go to Norton's site for complete instructions on removal of this virus.

w32.sircam.worm@mm.html" TARGET="_new">http://www.symantec.com/avcenter/venc/data/w32.sircam.worm@mm.html

epohl (MIS) · Answer 2 · 2001-07-23 11:15:29

Sorry that link should have been, and then choose sir.cam for removal instructions.

http://www.symantec.com/avcenter/vinfodb.html#threat_list

jrjuiliano (MIS) · Answer 3 · 2001-08-02 13:01:40

I've been dealing with this one the last few days with my relatives and other home users.

What a pain!

I had to stress that it was absolutely NECESSARY to have a good virus scanner, up-to-date definitions, yada yada yada.

It's funny how home users don't really get this one right off the bat!

Anyway, just thought I'd share.
J.R.

J.R. Juiliano
Information Systems Specialist
Tri-City Emergency Medical Group

**Guest** (visitor) · Answer 4 · 2001-08-31 11:25:59

I've been infected too. NAV quarantined the files and I'm not able to run any applications. Has anyone had any success in removing the worm manually as per the Norton instructions?

thanks.

jrjuiliano (MIS) · Answer 5 · 2001-08-31 11:38:13

My parents ran through the instructions with little or no problem from Symantec's site with their tool.

I believe they ended up running it in safe mode per the instructions, but it worked just fine.

Good luck!

J.R. Juiliano
Information Systems Specialist
Tri-City Emergency Medical Group

yvfwc (MIS) · Answer 6 · 2001-08-31 12:23:18

It has worked for some staff on their home pc's. See:

w32.sircam.worm@mm.html" TARGET="_new">http://www.sarc.com/avcenter/venc/data/w32.sircam.worm@mm.html

Cheers,

Mark

**Guest** (visitor) · Answer 7 · 2001-09-03 07:39:39

http://housecall.antivirus.com/housecall/

try this site you can use their online scanner or remove the worm yourself through their instructions

**Guest** (visitor) · Answer 8 · 2001-09-16 16:49:06

There's a removal way there. It worked for me under WinMe.
I'll never open/read strange e-mails!!!

http://www.acam.ca/SirC32/

AVChap (TechnicalUser) · Answer 9 · 2001-10-22 05:12:18

What you need to do is look for this registry key:

HKEY_CLASSES_ROOT\exefile\shell\open\command\Default

and change the entry to "%1" %*

This should fix the problem of executables looking for the SirCam file.

Cheers,

AVChap

Come Join Us!

Posting Guidelines

TROJ SIRCAM.1 - SirC32.exe