Welchia Attack- HELP!!

[ferrarimodena360]

i have got infected by msblast and welchia

i have run both fixblast and fixwelchia
and i have installed the msblast patch also

i have not found any patch for welchia (kindly post a link)

welchia keeps returning back and my fully updated norton 2003 keeps deleting it. kindly help.

i have run a thorough scan with NAV2003 but it says no viirus found but still everynow and then i get a welchia virus found warning.

i again ran fixwelchia and got this as the log;-

------------------------------------------------------------
The file "C:\WINDOWS\System32\wins\svchost.exe" is deleted.

W32.Welchia.Worm has been successfully removed
from your computer!

The total number of the scanned files: 14497
The number of deleted files: 1
The number of repaired files: 0
The number of viral processes terminated: 0
The number of viral services deleted: 0
The number of registry entries fixed: 0

-------------------------------------------------------------

but isnt svchost a legit windows file - my worry is that it has been deleted by fixwelchia


i wrote this in a hurry as my system keeps freezing

oh i am on winXP pro - and i dont have a firewall install - now if i install ZAP do i let it access the net

[ducttapeBigSexy]

Here's Symantec's site on welchia: http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html - it might help you remove it.

If you can't get rid of it with Norton, you might want to just forget it and reinstall your entire computer. Just remember that if you back up your files, make sure you scan them for viruses before you copy them back.

[cheapprick]

That was probably the best first post ever written.

I have to agree, if you can't use the Norton advice to manually remove it, burn all the file you need to keep and re-install.

[ferrarimodena360]

i just disabled my system restore and i have disabled \system volume information as an excludion from both automatic and manual scan in NAV2003


installed msblast patch
installed welchia patch (Thanx ducttapeBigSexy)

run fixblast - No Infection found
run fixwelchia - Removed Infection (deleted svchost)
Run NAV2003 - No Infection found

anything else?

[SimbaK2K]

next time keep ya anti virus and windows upto date :P Then you wouldn't of had these problems. Commonsense pays

[ducttapeBigSexy]

No, that should be it (unless it starts acting up again like most computers ;) ). To make sure this doesn't happen again, I do recommend keeping NAV and Windows up-to-date.

You can do this automatically under NAV2003 by going under the Options and choosing LiveUpdate. Check the box next to "Apply virus protection updates" and choose "Apply updates without interrupting me". You can also set Windows XP to update automatically by right clicking on My Computer, choose Properties, choose the Automatic Updates tab, and check the box and choose "Download the updates automatically." This should make the updating process much easier.

[phalkon30]

Yep, as said above, make sure you have EVERYTHING up to date.

I'd also recommend a firewall, this would have prevented msblast (not sure about welchia, never heard of it) from ever entering your system (windows update would have prevented this also).

To turn the XP built in firewall on, look at http://www.microsoft.com/windowsxp/pro/using/howto/networking/icf.asp

[shawners]

i like the way the help is given, its HInd site, and if he could go back he could do to change it. ALso that people change virus codes around once their is a patch or update, and it said that norton updates its virus defs. once a week on wendsday.. I know the virus did delete a important file on windows. IF your computer has files coming in, its known to miss a few viris before. And once its in, it will knock your virus utility off, and change its registery so it wont start.