Printable View
Hey there guys
Using Windows 2000 fully updated. Using nortons and ZL. Nortons picked up Welch virus in DLL host exe. It was unable to repair it so I downloaded the FixWelch to fix this probelm. However when I run it in normal and safe mode windows comes up with an error " Illegal opertion etc" and I have to cancel the scan before it gets to the windows folder where the virus is.
Is there anyway I can get around this.
Thank you verymuch for your time.
Something tells me you have a bit more than plain jane ol Welchia worm..
here is a go.. do a HJT scan in safemode and post it back here (HJT=HijackThis from http://www.merijn.org/
If Welchia is on your system IT WASNT PATCHED when it became infected.. it is probable that a few other bugs of the Agobot, gaobot families are probably present and accounted for (hmm prolly not if you managed to patch the box.. but It will be interesting to see the scan)
Welchia the anti naichi worm... the worm dosent shut down your PC..Quote:
Is Welch the same virus that shut downs the system after 60 sec or so?
The shutdow is due to the service, that the worm attacks, crashing.. the setting for the service require the system to restart (but can be modified to just allow the service to restart rather than the whole system)..
The common known Worms and the Service they are most known to attack ..
msblaster/Naichi - Remote Proceedure Call service (RPC/DCOM do a search on this site for this term)
Sasser - LSASS service
There are others..
Bloody hell :Singh:. delete ya bloody post next time ya bastard.. when some one is answering your question..
Seems like it could be the netsky virus as it causes rpc shutdown.
Anyway simple way to stop shutdown/restart is
Start-Run-(type)shutdown -a(enter)
Continue work normally
Undertaker it came up clean. I now installed Windows XP Sp1_a and updating as we speak. I will run the FixWelch when everything is updated. The ideal thing is to reformat both my hard drives but where do I back up my stuff? Got to get a DVD RE-Writer so i can save to Dvd disks. Ill let you guys know what happens. Thanks for the help.
It came up clean (no infection) or it cleaned it?Quote:
Undertaker it came up clean.
I'd be thinking about following Symantec's instructions for manual removal. If you're having that much trouble getting the tool to run are you going to trust the results if it does run?
I'd do the extra work just to double check and be safe.
http://securityresponse.symantec.com...chia.worm.html
C!der :
Where did you get your patches ?
MS update ? [When online click tools / windows update]
What other tools do you have installed - updated - and USE .......
Did you upgrade to XP, or dual boot ?
If you want to start afresh on two HDD's.
start with ONE .......
save data to a cleared area on 2.
reverse for second drive.
SP2 is on MS's update site too [75MB]
Undertaker: It came back with system clean however i dont think it found it. And the virus that restarts your PC is the blaster, i have the fix and dont have it.
Fox: I got the fix (FixWelch) from Systamec <--- cant spell :P website. It comes up with an error while running so it doesnt finish. My system is running slow.
Using Xp Sp1_a, going to fully update it tonight. Also using Avast home and Zl latest. Any comments.
Thanks
To give us / you a level playing field [?] follow the link, clean your system.Quote:
My system is running slow
clean up PC here
When you have finished your new XP set up, and you are happy with the performance.
Run HiJackThis [HJT] to give you a base line to check off from, should the worst ever happen again ............ just save the log somewhere that you'll remember, and label it something OBVIOUS :)
Did you upgrade to XP ?
Or dualboot ?
If you upgraded, did you really clean the Bast**d out ?
Or did you just install over, and format the existing partition ?