SCAM32.EXE File

[Richard Fason]

I would appreciate if you would plsease tell me how to reinstall the subject file.
A window pops with the flowing :
The c:\windows\systems\SCAM32.EXE file
appears to be corrupt. Reinstall the file
and try again.

Thank you
Richard Fason

[socalgal]

I don't think you want to install that file - it's part of the SIRCAM worm (virus).

Please read thoroughly (and apply) the info here and / or at your AV's website to make sure your system is clean.

http://www.symantec.com/avcenter/venc/data/w32.sircam.worm@mm.html

[This message has been edited by socalgal (edited 08-17-2001).]

[Imperion1]

I'm with SocalGal on this one. I've run every *.exe in all versions of Windows (except XP) to see what they do, even the ones in DOS. And I haven't even seen a SCAM32.exe file.

And to add to what SocalGal has said, be sure to also check your computer for this file.

[Richard Fason]

I found 2 SCAM32.EXE files.

#1 SCAM32 Type: Application. Origin: C:\
Size:4.50KB Ceated: July 24, 2001

#2 SCAM32 Type: Application. Origin: System.
Size: 85.2KB Created AUG. 17, 2001

I couldnt open them so I deleted them.
I hope I did right in deleting then.

Thanks for you help
Richard Fason

[PassnThru]

Yes - you did right to delete them. I am surprised that you saw them since they are normally hidden. It seems that you have gotten the SirCam virus. Deleting these files under the Windows/System directory is only the first step. Update your virus protection program and do a full scan. Make sure that you set your options to scan all files and to also scan the recycle bin - the SirCam virus hides here since most virus scan programs by default do not scan the recycle bin.
Actually, you are lucky. I just rebuilt a computer for a friend that had gotten the SirCam virus. He saved the attachment to his desktop and opened it. It deleted most of his folders. I finally isolated the exe and saved it to diskette and put it my computer - reported SirCam.Worm. Most SirCam viruses don't immediately delete but his did.

[Scorpio69]

I just got this one at work. It spread to a total of four machines before I squashed it. Pretty sneaky little worm.

[conjh13]

Yep, pretty sneaky alright. We got it here too, but managed to oust it. Fortunately it didn't spring the recycle bin trick on us, so we didn't have much trouble getting rid of it.

[Richard Fason]

Thanks. socalgal and all the other nice people that helped me.
I follower socalgal's instrutions and scaned my PC. After the scan it said removed one bad file or something to that effect.
After I deleted the two SCAM32 files I scaned my PC again. After the scan, it said found no virus.
Hopefuly I am clean now.

Thanks again, ya'll have a nice day.

[jman01pa]

What disadvantages are there to setting your heuristics to high all the time?

J http://www.sysopt.com/forum/smile.gif

[socalgal]

Hi Richard, I hope so too.

If you followed the instructions and /or used that "Removal Tool" (http://www.symantec.com/avcenter/venc/data/w32.sircam.worm@mm.removal.tool.html) I'd say you're OK.

Just keep your AV updated, do scans on a regular basis, and don't open email attachments unless you're expecting them and have scanned them first.

You can run the AV in "real-time" in your System Tray (systray) so virii can be detected immediately. http://www.sysopt.com/forum/wink.gif Also, set the 'heuristics' to maximum. You might also check your AV options for scanning email.

http://www.sysopt.com/forum/smile.gif

[This message has been edited by socalgal (edited 08-18-2001).]