Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Computing > Computer Support > Worm Problem

Reply
Thread Tools

Worm Problem

 
 
Steven Pua
Guest
Posts: n/a
 
      12-22-2003
hi i've Norton. And down loaded this fix it file from the website. But it
seem like it's repeating over and over again. Any suggestion that i can do
to solve this problem?

The worm name file is W32.WELCHIA.WORM

Steven


 
Reply With Quote
 
 
 
 
DaveG
Guest
Posts: n/a
 
      12-22-2003
http
"Steven Pua" <(E-Mail Removed)> wrote in message
news:bs7cju$r15$(E-Mail Removed)...
> hi i've Norton. And down loaded this fix it file from the website.

But it
> seem like it's repeating over and over again. Any suggestion that i

can do
> to solve this problem?
>
> The worm name file is W32.WELCHIA.WORM


://tinyurl.com/32b5b

Symantec Security Response has developed a removal tool to clean the
infections of W32.Welchia.Worm.


--
dg-2003

"You Graeme Souness?People say you look like me and Magnum" - Yosser
Hughes

 
Reply With Quote
 
 
 
 
DaveG
Guest
Posts: n/a
 
      12-22-2003
http://tinyurl.com/kdp6
 
Reply With Quote
 
°Mike°
Guest
Posts: n/a
 
      12-22-2003
http://www.symantec.com/avcenter/ven...chia.worm.html

Related BLASTER information:

Boot into Safe Mode and start your registry editor:
Start / Run / regedit

Navigate to:
HKEY_LOCAL_MACHINE
+Software
+Microsoft
+Windows
+CurrentVersion
+Run

In the right-hand pane, look for any entry/ies that include
MSBLAST.EXE, PENIS32.EXE or TEEKIDS.EXE and
DELETE it/them.
These are the files associated with the different variants:
Variant A - msblast.exe
Variant B - penis32.exe
Variant C - teekids.exe

You just disabled the worm from running at startup, so boot into
normal mode again, and turn off ALL system restores to purge
your system.

Open Windows Explorer to the ..\Windows\System32\ or
...\WinNT\System32\ folder and DELETE *any* of the
files named above.

Next, go to the ..\Windows\Prefetch\ or ..\WinNT\Prefetch\
and find the reference to the above file/s (any reference will
be similar to: <filename.exe>-<alphanumerics>.PF), for example,
msblast.exe-0235D8H6.pf, and DELETE it/them.

Now you can download and install the patch, configure your
firewall and update your virus scanner.

Virus Alert About the Blaster Worm and Its Variants
http://support.microsoft.com/default.aspx?kbid=826955

Microsoft Security Bulletin MS03-026
http://www.microsoft.com/technet/sec...n/MS03-026.asp

What you should know about the Blaster worm
http://www.microsoft.com/security/incident/blast.asp

Windows RPC DCOM Buffer Overflow Remote Exploit (MS03-026)
http://www.k-otik.com/exploits/07.25.winrpcdcom.c.php

How to Use The KB 823980 Scanning Tool to Identify Host Computers
That Do Not Have The 823980 Security Patch (MS03-026) Installed
http://support.microsoft.com/default.aspx?kbid=826369

W32.Blaster.Worm
http://www.symantec.com/avcenter/ven...ster.worm.html

W32.Blaster.B.Worm
http://www.symantec.com/avcenter/ven...er.b.worm.html

W32.Blaster.C.Worm
http://www.symantec.com/avcenter/ven...er.c.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/ven...oval.tool.html


On Tue, 23 Dec 2003 02:43:09 +0800, in
<bs7cju$r15$(E-Mail Removed)>
Steven Pua scrawled:

>hi i've Norton. And down loaded this fix it file from the website. But it
>seem like it's repeating over and over again. Any suggestion that i can do
>to solve this problem?
>
>The worm name file is W32.WELCHIA.WORM
>
>Steven
>


--
Basic computer maintenance
http://uk.geocities.com/personel44/maintenance.html
 
Reply With Quote
 
Patrick
Guest
Posts: n/a
 
      12-22-2003
Steven Pua wrote:
> hi i've Norton. And down loaded this fix it file from the website.
> But it seem like it's repeating over and over again. Any suggestion
> that i can do to solve this problem?
>
> The worm name file is W32.WELCHIA.WORM
>
> Steven


It is possible that the 'worm' is in your 'System Restore' files, said
SR-files cannot be accessed by a removal tool. Thus it is that your System
Restore' needs to be turned-off to clear the files, then run the 'removal
tool' and then turn 'System Restore' back on.

Please read the instructions at this 'Symantec' site for useing the
'removal-tool, especially concerning turning off 'System Restore'.
http://securityresponse.symantec.com...chia.worm.html

or; http://makeashorterlink.com/?U21C224A5


 
Reply With Quote
 
Thund3rstruck
Guest
Posts: n/a
 
      12-24-2003
Steven Pua Spilled my beer when they jumped on the table and
proclaimed in <bs7cju$r15$(E-Mail Removed)>:

> hi i've Norton. And down loaded this fix it file from the website.
> But it seem like it's repeating over and over again. Any suggestion
> that i can do to solve this problem?
>
> The worm name file is W32.WELCHIA.WORM


Don't know if this has been suggested yet, but if you have already
downloaded the fixer tool from Symantec's site, just turn off system
restore (If ME or XP), boot into safe mode, and run it until it
reports clean...

NOI
 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Security Experts Warn of Kama Sutra Worm (yet another MS worm) Imhotep Computer Security 4 01-30-2006 01:53 PM
Worm\Spybot (P2P-Worm.Win32.SpyBot.a) Danny Computer Information 0 08-14-2005 01:09 PM
worm/spybot.17.t (worm spybot 17t) detected by AVG code_wrong Computer Security 0 05-15-2004 04:40 PM
Antigen found VIRUS= I-Worm.Sobig.f (Kaspersky,CA(InoculateIT)) worm ANTIGEN_ML-MAIL Ruby 0 09-09-2003 07:11 PM
New anti-blaster worm attempts to fix RPC/DCOM vuln - W32/Nachi.worm Lord Shaolin Computer Security 6 08-20-2003 10:39 PM



Advertisments