SirC32.exe Error

[JW]

Hi,

I just clean a virus off of a friends computer. Gateway PIII 128 ram, 20 gb hard drive running win 95 spr3. Now when it boots up it keeps giving me this error that says "Cannot find SirC32.exe this is used to open applications" I've searched the Win 95 cd and Win98 cd and found nothing. Every app I try to open I get this message. It seems to be a windows file I just can't seem to find it. Any help is greatly appreciated!

thanks,
jw

[Floppyman]

Hi,

Is the error you are talking about or is it some other error?

http://securityresponse.symantec.com/avcenter/venc/data/sircam.error.message.html

HTH

[JW]

Thanks for your help floppyman but that wasn't it. What happens is my computer boots up fine just as the desktop finishes loading it get the error and any time I try to open just about any program I get it. I went to try to uninstall some programs and it wouldn't let me, giving me the same error. I went to Microsoft site and couldn't find any info on it either. any more help will be greatly appreciated.

jw

[oengus5]

You should go the the Symantec Antivirus Research Center (SARC) site and download FIXSIRC. Run that file, and it should fix your problem.

What you have is a leftover registry entry from the SIRCAM32 virus. Running FIXSIRC from Safe Mode will allow you to fix the problem.

Bob
(who spent 3 weeks killing that virus on his network).

[JW]

Yep that did the trick. I did just what you said and now its seems to work perfect. Many thanks for everyones help.

Thanks,
jw

[Hpro]

if you run into SIRC32 Viruse it can be a pain to remove it proper - there are several versions of it and those do function almost in the same way the most dangerous one is the one which creates Run32.exe which can be located in C:\Windows\System - it has READ ONLY and HIDDEN attributes set - to sucessfully remove the virus - if the virus is found by the AV program the DO NOT TOUCH IT major steps have be done first before touch the actual VIRUS and those major steps are to DISABLE the caller of the Virus..
Look at the step by step below..

The virus hides itself in the RECYCLE bin and also in C:\Windows\system ..
In the recylce bin it has the name SIRC32.EXE has a file size of 140Kb and the same you will find in C:\Windows\System\SCAM32.EXE - this is the actual Virus..

It will write entries into Autoexec.bat if there one is found with the path set to RECYCLE Bin.. it also will set the path in the REGISTRY in the RUN command lines of Local and user Keys..
Those ones have to be remove first before you go and actually remove the virus..

STEP By STEP..
1.Open Msconfig Select Autoexec.bat
2.If entry @Recycled\Sircam32.exe is in there - then unmark it..
3.Go to startup tab find the string SCAM32.EXE and disable it ..
Hit on safe and restart your computer - hit CTRL+ALT+DEL and look out for SCAM32.exe ifn not found then do followings..

Open the folder C:\Windows\System and Delete the following file
1.SCAM32.EXE
Open the folder C:\Windows and delete the file RUN32.EXE another part of the Virus..
Open RECYCLE BIN and then Delete the SIRCAM32.EXE in there -
Open C:\Windows\SYSBCKUP\ select the CAB files in there - this ouwld be the registry backups and delete them as those ones consist the Virus strings also..

then Run the AV scanner and check for left overs - Your system should be clean by now - If you are on LAN then make sure that all computers are DISCONNETED from the network and clean them up one by one - otherwise you will be infected right back..

When finished Run SFC and restore the some files like RUNDLL32.EXE as SIRCAM renamed them to RUN32.exe and made use for it - then you should actually be back up and running your computer without problems..
Hth

[systempat]

I had the Sircam virus. A real pain :eek: . I had to go thru some new tricks to get the registry fixed up after the actual virus was removed (mostly removed).
You can't run regedit because of the registry entry that blocks ALL .exe files.

The part that got me going again was from the documents on the McAfee (Symantec) site for doing the manual cleanup. Copy regedit.exe to regedit.com. Then specifically enter "regedit.com" in the Run window. Then it will run without triggering the registry entry. Then you can go into regedit and clean all the sircam and scam32 and Sirc32 entries. NOTE: this is not for the faint of heart about going into the registry. Best advice is to run anti-virus software and keep the definitions up-to-date. I now do, but I wasn't doing it before.:cool: