Question

Locked

Vista - virus - can't install anything

By ih54321 ·
Hi,

1st, I?m not great with computers, so please go easy on me... but

I use Vista and I have a 'virus' that is allowing popup ads and not allowing me to install anything.

It does not recognize .exe files

I can download files as the application and a part file, however as soon as the d/l has finished only the part file remains (with no information)

What can I do?


Cheers

This conversation is currently closed to new comments.

2 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Answers

Collapse -

Boot into safe mode

by jimmy-jam In reply to Vista - virus - can't ins ...

then run your spyware ad ware and anitvirus scans. This should permit a thorough cleaning.

Collapse -

If you are not comfortable

by Jacky Howe In reply to Vista - virus - can't ins ...

following these instructions take the PC to a Technician.
<br><br>
You cannot start programs when your computer is infected with the SirCam virus
<br><br>
http://support.microsoft.com/kb/311446
<br><br>
Cause
<br><br>
The W32.Sircam.Worm@mm worm virus can cause this issue. The W32/Sircam virus spreads itself through e-mail messages or unprotected network file shares and can reveal or delete information on your computer. To verify that your computer is infected with this kind of virus:
<br><br>
1. Restart your computer, press F8 at the Windows XP Startup menu, and then select Safe Mode with Command Prompt.
<br><br>
2. At the command prompt, type regedit, and press ENTER.
<br><br>
3. If the following registry key is set to C:\recycled\sirc32.exe "%1" %*, your computer is infected with the W32/SirCam worm virus: HKEY_CLASSES_ROOT\exefile\shell\open\command
<br><br>
Note If this registry setting is anything other than "%1" %* your computer may be infected with a different virus.
<br><br>

1. Verify that your computer is infected with the W32.Sircam.Worm@mm worm virus.
<br><br>
For information about how to do this, view the steps that are included in the "Cause" section of this article. If your computer is infected with the W32.Sircam.Worm@mm worm virus, continue to step 2. If your computer is not infected with the W32.Sircam.Worm@mm worm virus, skip the remaining steps, and then follow the instructions that are included in the "Resolution" section of this article.
<br><br>
2. Use Registry Editor to change the (Default) string value in the following registry key to "%1" %* (with quotation marks): HKEY_CLASSES_ROOT\exefile\shell\open\command\
<br><br>
3. At a command prompt, type cd \, and then press ENTER.
<br><br>
4. At a command prompt, type del /f /s /a sirc32.exe, and then press ENTER.
<br><br>
5. At a command prompt, type del /f /s /a scam32.exe, and then press ENTER.
<br><br>
6. At a command prompt, type shutdown -r, and then press ENTER.
<br><br>

The W32.Sircam.Worm@mm worm virus modifies the registry so that all executable (.exe) files are started through the virus file, Sirc32.exe, which reside in the C:\recycled folder. When you make this change to the registry, executable files are forced to to run as a command line argument to the Sirc32.exe file. Through the course of the upgrade to Windows XP, the Sirc32.exe file is removed.
<br><br>
The removal of the Sirc32.exe virus without modification of the HKEY_CLASSES_ROOT\Exefile\Shell\Open\Command key will invalidate every executable file on the computer because, according to this line in the registry, the executable files are to be run as a command line parameter to the Sirc32.exe file which no longer exists. This prompts the "Windows cannot find" message when you try to start the executable file.
<br><br>


<i>Keep us informed as to your progress if you require further assistance.</i>

<br><br>
<font size=1><i>If you think that any of these posts have solved or contributed to solving the problem, please Mark them as <b>Helpful</b> so that others may benefit from the outcome.</i></font size>

Back to Malware Forum
2 total posts (Page 1 of 1)  

Related Discussions

Related Forums