[Resolved] W32/SirCam@mm worm virus {in Win XP}

[sirflyguy2000]

I recently upgraded to XP from ME. I immediately encountered problems opening programs from shortcuts or from the program menu. I get error messages about being unable to run program because it can't find it. Anyway, I found out I had the W32/Sircam worm virus, which causes the inability to launch exe. files. Microsoft tried to help, but whatever I tried after removing the virus hasn't fixed the problem. I can't even uninstall XP or do a system restore (it goes through the motions of doing system restore, but at the end of the process, I get the error message again). I can open programs by right clicking the shortcut or program name in the program menu, and then selecting "Run As", and then deselecting the protection option. I ran McAffee Antivirus several times to make sure the virus was gone, and it seems to be gone. Anyway, Dell tells me they want me to contact Norton to check to make sure there is no virus, even though the Norton program ceased to work when I upgraded to XP (incompatible). I can't find my startup disk so I can f-disk the hard drive, and Dell won't do anything until I talk to Norton. I just want my computer to work! Please help me. Thank you. Sirflyguy2000

 

[joturner19]

I don't know if you have already tried this because you didn't mention it.
The sircam virus removes the rundll32.exe file from the c:\winnt\system32 or c:\windows\system directory. This will stop any program from opening such as Control Panel options, Word documents etc. What you have to do is find the Rundll32.exe file from another working machine and copy to a floppy disk, Copy it back into the system folder and restart your machine. The next time you go into Word etc it should run correctly.
It is recommended that you run the Sircam fix if you haven't already done so before copying the Rundll32.exe file.
I hope this helps you out.

 

[Rollin' Rog]

Symantec has a fixtool for Sircam, whether it runs on XP I don't know.

http://www.symantec.com/avcenter/venc/data/w32.sircam.worm@mm.removal.tool.html

And another one here:

http://www.prolandsoftware.com/download/cleansc.htm

 

[sirflyguy2000]

I will try both of your suggestions. Thanks, and I will let you know the outcome> Sirflyguy2000

 

[fisher88]

Does the rundll32.exe file have to come from a machine with XP loaded? Or can it come from a machine with ME or 98SE? sirflyguy is my brother and I was going to put it on a floppy for him. I have ME and 98SE.

 

[sirflyguy2000]

The fix file @ Symantec took care of the problem, and even fixed my registry. Thanks to all who helped! Sirflyguy2000

 

[Rollin' Rog]

Great, nice to know it does the job for XP