PDA

View Full Version : sircam.worm destroyed files

papertech
10-22-2001, 10:37 PM
I'm helping a friend with PC problems after a shareware download (Excel reader?). Slaved her hard drive to another system, scanned with NAV - detected and quaranteened W32.sircam.worm@mm. Put drive back into original system. This all happened on Oct 3rd. Once drive back working in original system, realized date had been moved forward several days. Appears all files were lost, but there's a 2.6GB, Win386.swp file left in the Windows folder along with "AutoInch" (MS-DOS name: AUTOLNCH.REG, Type: Registration Entries). I'm guessing that AutoInch needs to be deleted, as it wants to edit the registry. I'm wondering about the swap file.....can it be used to recover files? AutoInch then Win386.swp were the last files copied to the drive before the worm deployed it's destructive payload.

Thanks lots for any insight.
YODA74
10-22-2001, 10:54 PM
you got this far I'm sure you may have read this but just in case
http://www.symantec.com/avcenter/venc/data/w32.sircam.worm@mm.html

someone else can probobly give you an idea on that file I'm just not sure.
personally I would wipe out every thing and start from scratch but wait on someone else.

------------------
W/Me (memory eater)
Me Help (http://www.webtechgeek.com/center_Frame_win_me_tips.html)
BUDS TS. (http://www.geocities.com/~budallen/whatsnew.html)
answers (http://www.dewassoc.com/support/index.html)
Paleo Pete
10-23-2001, 10:18 AM
From our previous dealings with this virus it seems that a full format and reinstall is usually the most effective way to deal with it. Removal applications have been produced, but so far I haven't seen any of them that made it here to the forums completely and successfully removed.

I always recommend formatting/reinstalling as a last resort only, but with almost any virus it usually turns out to be the best way to go.

------------------
Support the right to keep and arm bears.
Note: Please post your questions on the forums, not in my email.

Computer Information Links (http://www.dreamwater.com/paleopete/computer.htm) has been moved, please update your bookmarks.