SIRCAM

We just got hit with the Sircam mass-mailing worm. The owner had it and sent it to a ton of people.

I used the FIXSIRC.COM tool from http://www.sarc.com since our antivirus program is obvious out of date. The FIXSIRC.COM file found every computer in the office infected, and cured all but mine. I'm the sucker with Windows ME. Everyt ime I run it it tells me taht it couldn't fix all the files and to run it again in Safe Mode. I even get this message when I run it is Safe Mode.

Question: Is it possible that the FIXSIRC.COM tool on SARC's site is detecting files that aren't the virus? It looks like only one computer was mailing the stuff out. Maybe I don't really have it?

It could be possible.... After reading your post, I downloaded the cleaner and ran it on several of our systems (all of them were clean) and in each case, it reported no infection found.

disable system restore then boot off a 98 boot disk. Deltree the _restore directory from dos then reboot and try cleaning it.

re-read the link you posted, mostly the part where it says CAUTION:

the FIXSIRC.com utility seems to have disappeared from their site...anywhere else to get it? or am i looking in the wrong place?

http://www.symantec.com/avcenter/ven...oval.tool.html

I love this virus

virus, worm, smtp engine, it does it all.

If they find the guy they will either throw his *** in jail or hire him on the spot to show them how the hell he did it. <IMG SRC="smilies/biggrin.gif" border="0">

What gives?

I can't say "A$$" without the "***" marks coming up.

Mr.Moderator, isn't this a little extreme?

Please - I agree with the moderators, we all know what was meant by the *** - please don't make an issue.

Thanks

Got a customer's machine here where they're using some bizarre antivirus that detected and cleaned the worm, but only AFTER it had already done its damage.

Now the fix from Symantec won't fix the damage done, because it says the system isn't infected!!! <IMG SRC="smilies/mad.gif" border="0"> <IMG SRC="smilies/mad.gif" border="0"> <IMG SRC="smilies/mad.gif" border="0">

Quote:

---

Originally posted by Wayward Clam:
<STRONG>Got a customer's machine here where they're using some bizarre antivirus that detected and cleaned the worm, but only AFTER it had already done its damage.

Now the fix from Symantec won't fix the damage done, because it says the system isn't infected!!! <IMG SRC="smilies/mad.gif" border="0"> <IMG SRC="smilies/mad.gif" border="0"> <IMG SRC="smilies/mad.gif" border="0"></STRONG>

---

What's the anti-virus program anyways? Gotta love good ol CR, one of my best friends works at one <IMG SRC="smilies/biggrin.gif" border="0">