Bad System Configuration
- If you try to start a program (.exe file), the program may not start, and you may receive any one of the following error messages:
310585 You are unable to start a program with an .exe file extension
- The specific path does not exist. Check the path and try again.
- Windows cannot find 'program_file'. Make sure you typed the name correctly, and then try again. To search for a file, click Start, and then click Search.
- Additionally, if you upgrade your computer, you may receive the following message, where filename is the full path and the specific file mentioned in the message: Windows cannot find C:\Filename
In this case, when you start Registry Editor, you may receive the following error message:Windows cannot find C:\Windows\Regedit.exe
- Restart your computer, press F8 at the Windows XP Startup menu, and then select Safe Mode with Command Prompt.
- At the command prompt, type regedit, and press ENTER.
- If the following registry key is set to
C:\recycled\sirc32.exe "%1" %*, your computer is infected with the W32/SirCam worm virus:HKEY_CLASSES_ROOT\exefile\shell\open\commandNote If this registry setting is anything other than"%1" %*your computer may be infected with a different virus.
How to try to prevent the virus from running
- Verify that your computer is infected with the W32.Sircam.Worm@mm worm virus.
For information about how to do this, view the steps that are included in the "Cause" section of this article. If your computer is infected with the W32.Sircam.Worm@mm worm virus, continue to step 2. If your computer is not infected with the W32.Sircam.Worm@mm worm virus, skip the remaining steps, and then follow the instructions that are included in the "Resolution" section of this article.
- Use Registry Editor to change the (Default) string value in the following registry key to "%1" %* (with quotation marks):HKEY_CLASSES_ROOT\exefile\shell\open\command\
- At a command prompt, type cd \, and then press ENTER.
- At a command prompt, type del /f /s /a sirc32.exe, and then press ENTER.
- At a command prompt, type del /f /s /a scam32.exe, and then press ENTER.
- At a command prompt, type shutdown -r, and then press ENTER.
- Follow the instructions that are included in the "Resolution" section of this article.
The removal of the Sirc32.exe virus without modification of the HKEY_CLASSES_ROOT\Exefile\Shell\Open\Command key will invalidate every executable file on the computer because, according to this line in the registry, the executable files are to be run as a command line parameter to the Sirc32.exe file which no longer exists. This prompts the "Windows cannot find" message when you try to start the executable file.
Additional information about how to remove W32/Sircam virusFor additional information about how to correctly remove the W32/Sircam virus, please see the following third-party Web sites:
Availability of W32.Sircam.Worm@mm Removal toolsFor information about tools you can use to correctly remove the W32/Sircam virus, please see the following third-party Web sites:
For more information, click the following article number to view the article in the Microsoft Knowledge Base:
Article ID: 311446 - Last Review: Aug 18, 2009 - Revision: 1