My wife’s NTWS 4.0 machine is infected with the Sircam email worm. It was not 100% effective but it has rendered her NT OS useless. The registry’s default EXE file startup key, “[HKCR\exefile\shell\open\command]” has been changed by the worm to “[e:\recycled\SirC32.exe” “%1″ %*]”. This has the effect of short-circuiting all EXE files, preventing them from running. Also, it generates a window saying, “SirC32.exe” cannot be found”. Each program I attempt to run (including regedit, regedit32,redisk, etc.) generates another “SirC32.exe cannot be found” dialogue box. It has also created a startup key for another file, scam32.exe, (which was) located in the system32 directory.
I NEED to be able to run regedit before NT bubbles up.
Ideas? BTW, this machine is dual-boot running System Commander. The former OS was win98, and it may be operable. (It has been over a year since my wife used win98.)
Thx
Jim Baugh
highrise@csi.com
