rev3nant
Silver Member | Редактировать | Профиль | Сообщение | Цитировать | Сообщить модератору
Цитата: Although other message body possibilities are present in the virus,
these aren't actually being generated frequently.
Attached will be a document with a double extension (the filename varies). The first extension will be the file type which was prepended by the virus. When run, the document will be saved to the C:\RECYCLED folder and then opened while the virus copies itself to C:\RECYCLED\SirC32.exe folder to conceal its presence and create the following registry key value to load itself whenever .EXE files are executed:
HKEY_CLASSES_ROOT\exefile\shell\open\command
\Default="C:\recycled\SirC32.exe" "%1" %*
As the RECYCLE BIN is often on the exclusion list, check your settings to insure that this directory IS being scanned.
It also copies itself to the WINDOWS SYSTEM directory as SCam32.exe and creates the following registry key value to load itself automatically:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
RunServices\Driver32=C:\WINDOWS\SYSTEM\SCam32.exe
A list of .GIF, .JPG, .JPEG, .MPEG, .MOV, .MPG, .PDF, .PNG, .PS, and .ZIP files in the MY DOCUMENTS folder is saved to the file SCD.DLL (the 2nd character of the name appears to be random) in the SYSTEM directory. Email addresses are gathered from the Windows Address Book and temporary Internet cached pages and saved to the file SCD1.DLL (the 2nd and 3rd character of the name appears to be random) in the SYSTEM directory.
The worm prepends a copy of the files that are named in the SCD.DLL file and attaches this copy to the email messages that it sends via a built in for communicating directly with a SMTP server, using one of the following extensions: .BAT, .COM, .EXE, .LNK, .PIF. This results in attachment names having double-extensions.
The program creates a registry key to store variables for itself (such as a run count, and SMTP information):
HKEY_LOCAL_MACHINE\Software\Sircam
The virus may also infect other systems by using open network shares. On remote systems the file \windows\rundll32.exe may get replaced with a viral copy, while the valid RUNDLL32.EXE file is renamed to RUN32.EXE. On those systems, the AUTOEXEC.BAT file may be appended with the line: @win \recycled\sirc32.exe.
Aside from e-mail overloading, it may delete files and/or fill up harddisk space by adding text entries over & over again to a sircam recycle bin file. |
SirCam remover от McAfee
Добавлено
Или ручками:
Цитата: 1) Click START|RUN, type
COMMAND /C COPY %WINDIR%\REGEDIT.EXE %WINDIR%\REGEDIT.COM
and hit ENTER
2) Click START | RUN, type regedit.com and hit ENTER
3) Remove references to the virus from this registry key
HKEY_CLASSES_ROOT\exefile\shell\open\command\
It should contain only the value (not including brackets) : ["%1" %*]
4) Delete the following registry keys:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
RunServices\Driver32
HKEY_LOCAL_MACHINE\Software\Sircam
--- File Removal Instructions ---
Failure to complete the Registry Removal Instructions before starting these file removal instructions will result in the in ability to run applications. Do not proceed until the registry has been corrected as mentioned above!
1) Click START | RUN type, command.com and hit ENTER
2) Type, attrib -h c:\recycled\sirc32.exe and hit ENTER
3) Type, del c:\recycled\sirc32.exe and hit ENTER
Win9x/ME users only:
4) Type, attrib -h c:\windows\system\scam32.exe and hit ENTER
5) Type, del c:\windows\system\scam32.exe and hit ENTER
6)Type, move c:\windows\run32.exe c:\windows\rundll32.exe and hit ENTER
If prompted for Overwrite the file, choose (Y)es
If Cannot move ... appears then the virus did not move the Rundll32.exe file.
WinNT/2000 users only:
4) Type, attrib -h c:\winnt\system32\scam32.exe and hit ENTER
5) Type, del c:\winnt\system32\scam32.exe and hit ENTER
6) Type, move c:\winnt\run32.exe c:\winnt\rundll32.exe and hit ENTER
If prompted for Overwrite the file, type Y for (Y)es
If Cannot move ... appears then the virus did not move the Rundll32.exe file.
Win9x/ME/NT/2000 users:
(Note: as the Autoexec.bat file is not modified in all instances, steps 9, 10, and 11 may fail for some users. If this happens, then they were not required.)
7) Type exit and hit ENTER
8) Click START | RUN, type write c:\autoexec.bat and hit ENTER
9) Click EDIT | REPLACE, type @win \recycled\sirc32.exe and click REPLACE ALL
10) Click OK
11) Click FILE | EXIT and choose YES to save your changes |
|
. В общем, они заливаются в папку WUTemp и по окончании установки оттуда стираются 
- успеешь перенсести в другую папку - твоё счастье
