To edit the registry:
The worm modifies the registry such that an infected file is executed every time that you run a .exe file. Follow these instructions to fix this.
Copy Regedit.exe to Regedit.com:
Because the worm modified the registry so that you cannot run .exe files, you must first make a copy of the Registry Editor as a file with the .com extension, and then run that file.
1. Do one of the following, depending on which operating system you are running:
Windows 95/98 users: Click Start, point to Programs, and click MS-DOS Prompt. This opens a DOS window at the C:\Windows prompt. Go on to step 2 of this section.
Windows Me users: Click Start, point to Programs, point to Accessories, and then click MS-DOS Prompt. This opens a DOS window at the C:\Windows prompt. Go on to step 2 of this section.
Windows NT/2000 users:
a. Click Start, and click Run.
b. Type the following and then press Enter:
command
A DOS window opens.
c. Type the following and then press Enter:
cd \winnt
d. Go on to step 2 of this section.
Windows XP:
a. Click Start, and click Run.
b. Type the following and then press Enter:
command
A DOS window opens.
c. Type the following and then press Enter after typing each one:
cd\
cd \windows
d. Proceed to step 2 of this section.
2. Type the following and then press Enter:
copy regedit.exe regedit.com
3. Type the following and then press Enter:
start regedit.com
The Registry Editor will open in front of the DOS window. After you finish editing the registry, exit the Registry Editor, and then exit the DOS window, as well.
1. Proceed to the next section, "To edit the registry and remove keys and changes made by the worm," only after you have accomplished the previous steps.
NOTE: This will open the Registry Editor in front of the DOS window. After you finish editing the registry and have closed Registry Editor, close the DOS window.
To edit the registry and remove keys and changes made by the worm:
CAUTION: We strongly recommend that you back up the system registry before making any changes. Incorrect changes to the registry can result in permanent data loss or corrupted files. Please make sure you modify only the keys specified in this document. For more information about how to back up the registry, please read How to back up the Windows registry before proceeding with the following steps. If you are concerned that you cannot follow these steps correctly, then please do not proceed. Consult a computer technician for more information.
1. Navigate to and select the following key:
HKEY_CLASSES_ROOT\exefile\shell\open\command
CAUTION: The HKEY_CLASSES_ROOT key contains many subkey entries that refer to other file extensions. One of these file extensions is .exe. Changing this extension can prevent any files ending with an .exe extension from running. Make sure you browse all the way along this path until you reach the \command subkey.
Do not modify the HKEY_CLASSES_ROOT\.exe key.
Do modify the HKEY_CLASSES_ROOT\exefile\shell\open\command subkey that is shown in the following figure:
<<=== NOTE: This is the key that you need to modify.
2. Double-click the (Default) value in the right pane.
3. Delete the current value data, and then type: "%1" %* (That is, type the following characters: quote-percent-one-quote-space-percent-asterisk.)
NOTE: On Win9x and WinNT systems, the Registry Editor will automatically enclose the value within quotation marks. When you click OK, the (Default) value should look exactly like this: ""%1" %*" On Win2k systems, the addtional quotation marks will not appear. On Win2k systems, the (Default) value should look exactly like this: "%1" %*
4. Make sure you completely delete all value data in the command key prior to typing the correct data. If a space is left accidentally at the beginning of the entry, any attempt to run program files will result in the error message, "Windows cannot find .exe." or "Cannot locate C:\ <path and file name>."
5. Navigate to and select the following key:
HKEY_LOCAL_MACHINE\Software\SirCam
CAUTION: Make sure that you go all the way down to the SirCam key, and that it is selected. It will look similar to the following figure:
6. With the SirCam key selected, press Delete and then click Yes to confirm.. This will delete the key and all of its subkeys. Since this key was created by the worm it can be safely deleted.
7. Navigate to and select the following key:
HKEY_LOCAL_MACHINE\Software\
Microsoft\Windows\CurrentVersion\RunServices
8. In the right pane, look for and select the value
Driver32.
9. Press Delete, and then click Yes to confirm
http://www.symantec.com/avcenter/venc/data/w32.sircam.worm@mm.html