Results 1 to 9 of 9

Thread: FixWelch, wont run

  1. #1
    Junior Member
    Join Date
    Dec 2003
    Posts
    10

    FixWelch, wont run

    Hey there guys

    Using Windows 2000 fully updated. Using nortons and ZL. Nortons picked up Welch virus in DLL host exe. It was unable to repair it so I downloaded the FixWelch to fix this probelm. However when I run it in normal and safe mode windows comes up with an error " Illegal opertion etc" and I have to cancel the scan before it gets to the windows folder where the virus is.

    Is there anyway I can get around this.

    Thank you verymuch for your time.
    Tyron Rohland

  2. #2
    The Doctor Und3ertak3r's Avatar
    Join Date
    Apr 2002
    Posts
    2,744
    Something tells me you have a bit more than plain jane ol Welchia worm..

    here is a go.. do a HJT scan in safemode and post it back here (HJT=HijackThis from http://www.merijn.org/

    If Welchia is on your system IT WASNT PATCHED when it became infected.. it is probable that a few other bugs of the Agobot, gaobot families are probably present and accounted for (hmm prolly not if you managed to patch the box.. but It will be interesting to see the scan)
    "Consumer technology now exceeds the average persons ability to comprehend how to use it..give up hope of them being able to understand how it works." - Me http://www.cybercrypt.co.nr

  3. #3
    The Doctor Und3ertak3r's Avatar
    Join Date
    Apr 2002
    Posts
    2,744
    Is Welch the same virus that shut downs the system after 60 sec or so?
    Welchia the anti naichi worm... the worm dosent shut down your PC..
    The shutdow is due to the service, that the worm attacks, crashing.. the setting for the service require the system to restart (but can be modified to just allow the service to restart rather than the whole system)..

    The common known Worms and the Service they are most known to attack ..
    msblaster/Naichi - Remote Proceedure Call service (RPC/DCOM do a search on this site for this term)
    Sasser - LSASS service

    There are others..

    Bloody hell :Singh:. delete ya bloody post next time ya bastard.. when some one is answering your question..
    "Consumer technology now exceeds the average persons ability to comprehend how to use it..give up hope of them being able to understand how it works." - Me http://www.cybercrypt.co.nr

  4. #4
    Seems like it could be the netsky virus as it causes rpc shutdown.
    Anyway simple way to stop shutdown/restart is
    Start-Run-(type)shutdown -a(enter)
    Continue work normally

  5. #5
    Junior Member
    Join Date
    Dec 2003
    Posts
    10
    Undertaker it came up clean. I now installed Windows XP Sp1_a and updating as we speak. I will run the FixWelch when everything is updated. The ideal thing is to reformat both my hard drives but where do I back up my stuff? Got to get a DVD RE-Writer so i can save to Dvd disks. Ill let you guys know what happens. Thanks for the help.
    Tyron Rohland

  6. #6
    Senior Member
    Join Date
    Mar 2004
    Posts
    510
    Undertaker it came up clean.
    It came up clean (no infection) or it cleaned it?

    I'd be thinking about following Symantec's instructions for manual removal. If you're having that much trouble getting the tool to run are you going to trust the results if it does run?

    I'd do the extra work just to double check and be safe.

    http://securityresponse.symantec.com...chia.worm.html
    \"You got a mouth like an outboard motor..all the time putt putt putt\" - Foghorn Leghorn

  7. #7
    They call me the Hunted foxyloxley's Avatar
    Join Date
    Nov 2003
    Location
    3rd Rock from Sun
    Posts
    2,534
    C!der :
    Where did you get your patches ?
    MS update ? [When online click tools / windows update]

    What other tools do you have installed - updated - and USE .......

    Did you upgrade to XP, or dual boot ?

    If you want to start afresh on two HDD's.
    start with ONE .......
    save data to a cleared area on 2.
    reverse for second drive.
    SP2 is on MS's update site too [75MB]
    so now I'm in my SIXTIES FFS
    WTAF, how did that happen, so no more alterations to the sig, it will remain as is now

    Beware of Geeks bearing GIF's
    come and waste the day :P at The Taz Zone

  8. #8
    Junior Member
    Join Date
    Dec 2003
    Posts
    10
    Undertaker: It came back with system clean however i dont think it found it. And the virus that restarts your PC is the blaster, i have the fix and dont have it.
    Fox: I got the fix (FixWelch) from Systamec <--- cant spell :P website. It comes up with an error while running so it doesnt finish. My system is running slow.

    Using Xp Sp1_a, going to fully update it tonight. Also using Avast home and Zl latest. Any comments.

    Thanks
    Tyron Rohland

  9. #9
    They call me the Hunted foxyloxley's Avatar
    Join Date
    Nov 2003
    Location
    3rd Rock from Sun
    Posts
    2,534
    My system is running slow
    To give us / you a level playing field [?] follow the link, clean your system.
    clean up PC here

    When you have finished your new XP set up, and you are happy with the performance.
    Run HiJackThis [HJT] to give you a base line to check off from, should the worst ever happen again ............ just save the log somewhere that you'll remember, and label it something OBVIOUS

    Did you upgrade to XP ?
    Or dualboot ?

    If you upgraded, did you really clean the Bast**d out ?

    Or did you just install over, and format the existing partition ?
    so now I'm in my SIXTIES FFS
    WTAF, how did that happen, so no more alterations to the sig, it will remain as is now

    Beware of Geeks bearing GIF's
    come and waste the day :P at The Taz Zone

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •