Repairing Win95

Greetings,

In addition to the fixes you implemented from McAffee and Microsoft Tools, try downloading this one. Cut and paste the following URL into your browser (REMOVING SPACES if they snuck into the pasted URL):

http://www.jan.norcom.mb.ca/shop/July-Aug01/sircam.htm

If you still have problems after running all those fixes, try installing Windows over itself. That way you have a chance of repairing damaged files without losing your data. If you're still having problems, you may have no choice but to reformat and do a fresh Windows installation. If you do indeed have to resort to that, an easy way to save your data is to temporarily install a second hard drive as a slave, and simply copy your data files onto that slave drive. Putthe data back on your fresh drive after the install. (You may have to remove that slave drive while reinstalling Windows.) Be cautious, however, to not copy any files that may have been affected by the virus.

Good luck,

Maxwell

To install windows over itself in order to keep all registry entries and installed programs intact use the setup /p f command. However- if files were damaged by the virus for other programs -- you will have to reinstall those to restore functionality also. You may not be aware of lost functionality until a program makes a call to a damaged dll or other file.
Thanks

Once a virus has done that much damage, copy the users documemts to a back up medum. Fdisk and repartition then format the affected drive. Reinstall windows and before any thing else install the virus scanner and update it! then copy the docs back and run the scanner at least twice. If you get the virus back tell the user that all his docs are gone. Dont you love virus writers!

You don't mention the error you see, but I have seen something like this when the run32dll.exe is not restored correctly. Extract this file from the .cab, and overwrite the existing file before trying a format.

Please all the details on the following link

http://www.symantec.com/avcenter/venc/data/w32.sircam.worm@mm.html

Rundll32.exe and run32.exe may have been infested; please extract them from the windows CD.
Details are found in the above link.

More info:
http://www.europe.f-secure.com/v-descs/sircam.shtml

In addition to the rundll32.exe being replaced SirCam replaces a registry entry for the run operation of ALL .exe files the problem is that you cannot run regedit (a .exe) to repair the damage. The only answer would be to reinstall the OS, and to way to ensure you do not loose data is to control the setup yourself. Start from a boot disk and DO NOT let the setup start automatically as this usually runs a format first. If you are using a OEM or Full version of Win95 ( not an upgrade) you may need to delete IO.sys MSDOS.sys ( in root c:\) both hidden files and rename WIN.COM WIN.INI and SYSTEM.INI, this will prevent the setup error that does not let you reinstall because you already have an OS on the machine. You will also have to reinstall your applications afterwards as well.

I have used the Symantec removal tool on a number of PCs and to be haven't noticed any further problems. The only caveat is that you have to remember to remove the entry in autoexec.bat, otherwise you get an error on startup AND don't forget to remove those root shares!

Oscar,
I've cleaned a few of these machines and the error on Regedit stopped me too. I did find one way around it though. This file can be renamed to Regedit.com, temporarily. Then you can fix the registry error and rename it back. I also have had one machine that did not cleanup in any way and could have used the reinstall-over option with the parameters listed in a message above, to save the registry. Is the switch /p f ? Is this correct or do we need to make it /pf or /p /f ?

This question was auto closed due to inactivity