Worm Problem

Discussion in 'Computer Support' started by Steven Pua, Dec 22, 2003.

  1. Steven Pua

    Steven Pua Guest

    hi i've Norton. And down loaded this fix it file from the website. But it
    seem like it's repeating over and over again. Any suggestion that i can do
    to solve this problem?

    The worm name file is W32.WELCHIA.WORM

    Steven
    Steven Pua, Dec 22, 2003
    #1
    1. Advertising

  2. Steven Pua

    DaveG Guest

    http
    "Steven Pua" <> wrote in message
    news:bs7cju$r15$...
    > hi i've Norton. And down loaded this fix it file from the website.

    But it
    > seem like it's repeating over and over again. Any suggestion that i

    can do
    > to solve this problem?
    >
    > The worm name file is W32.WELCHIA.WORM


    ://tinyurl.com/32b5b

    Symantec Security Response has developed a removal tool to clean the
    infections of W32.Welchia.Worm.


    --
    dg-2003

    "You Graeme Souness?People say you look like me and Magnum" - Yosser
    Hughes
    DaveG, Dec 22, 2003
    #2
    1. Advertising

  3. Steven Pua

    DaveG Guest

    DaveG, Dec 22, 2003
    #3
  4. Steven Pua

    °Mike° Guest

    http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.html

    Related BLASTER information:

    Boot into Safe Mode and start your registry editor:
    Start / Run / regedit

    Navigate to:
    HKEY_LOCAL_MACHINE
    +Software
    +Microsoft
    +Windows
    +CurrentVersion
    +Run

    In the right-hand pane, look for any entry/ies that include
    MSBLAST.EXE, PENIS32.EXE or TEEKIDS.EXE and
    DELETE it/them.
    These are the files associated with the different variants:
    Variant A - msblast.exe
    Variant B - penis32.exe
    Variant C - teekids.exe

    You just disabled the worm from running at startup, so boot into
    normal mode again, and turn off ALL system restores to purge
    your system.

    Open Windows Explorer to the ..\Windows\System32\ or
    ...\WinNT\System32\ folder and DELETE *any* of the
    files named above.

    Next, go to the ..\Windows\Prefetch\ or ..\WinNT\Prefetch\
    and find the reference to the above file/s (any reference will
    be similar to: <filename.exe>-<alphanumerics>.PF), for example,
    msblast.exe-0235D8H6.pf, and DELETE it/them.

    Now you can download and install the patch, configure your
    firewall and update your virus scanner.

    Virus Alert About the Blaster Worm and Its Variants
    http://support.microsoft.com/default.aspx?kbid=826955

    Microsoft Security Bulletin MS03-026
    http://www.microsoft.com/technet/security/bulletin/MS03-026.asp

    What you should know about the Blaster worm
    http://www.microsoft.com/security/incident/blast.asp

    Windows RPC DCOM Buffer Overflow Remote Exploit (MS03-026)
    http://www.k-otik.com/exploits/07.25.winrpcdcom.c.php

    How to Use The KB 823980 Scanning Tool to Identify Host Computers
    That Do Not Have The 823980 Security Patch (MS03-026) Installed
    http://support.microsoft.com/default.aspx?kbid=826369

    W32.Blaster.Worm
    http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

    W32.Blaster.B.Worm
    http://www.symantec.com/avcenter/venc/data/w32.blaster.b.worm.html

    W32.Blaster.C.Worm
    http://www.symantec.com/avcenter/venc/data/w32.blaster.c.worm.html

    W32.Blaster.Worm Removal Tool
    http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html


    On Tue, 23 Dec 2003 02:43:09 +0800, in
    <bs7cju$r15$>
    Steven Pua scrawled:

    >hi i've Norton. And down loaded this fix it file from the website. But it
    >seem like it's repeating over and over again. Any suggestion that i can do
    >to solve this problem?
    >
    >The worm name file is W32.WELCHIA.WORM
    >
    >Steven
    >


    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
    °Mike°, Dec 22, 2003
    #4
  5. Steven Pua

    Patrick Guest

    Steven Pua wrote:
    > hi i've Norton. And down loaded this fix it file from the website.
    > But it seem like it's repeating over and over again. Any suggestion
    > that i can do to solve this problem?
    >
    > The worm name file is W32.WELCHIA.WORM
    >
    > Steven


    It is possible that the 'worm' is in your 'System Restore' files, said
    SR-files cannot be accessed by a removal tool. Thus it is that your System
    Restore' needs to be turned-off to clear the files, then run the 'removal
    tool' and then turn 'System Restore' back on.

    Please read the instructions at this 'Symantec' site for useing the
    'removal-tool, especially concerning turning off 'System Restore'.
    http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

    or; http://makeashorterlink.com/?U21C224A5
    Patrick, Dec 22, 2003
    #5
  6. Steven Pua Spilled my beer when they jumped on the table and
    proclaimed in <bs7cju$r15$>:

    > hi i've Norton. And down loaded this fix it file from the website.
    > But it seem like it's repeating over and over again. Any suggestion
    > that i can do to solve this problem?
    >
    > The worm name file is W32.WELCHIA.WORM


    Don't know if this has been suggested yet, but if you have already
    downloaded the fixer tool from Symantec's site, just turn off system
    restore (If ME or XP), boot into safe mode, and run it until it
    reports clean...

    NOI
    Thund3rstruck, Dec 24, 2003
    #6
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Fudge

    Latest Worm Problem

    Fudge, May 2, 2004, in forum: Computer Support
    Replies:
    10
    Views:
    747
    Toolman Tim
    May 3, 2004
  2. Lord Shaolin
    Replies:
    6
    Views:
    2,508
    John Tate
    Aug 20, 2003
  3. code_wrong

    worm/spybot.17.t (worm spybot 17t) detected by AVG

    code_wrong, May 15, 2004, in forum: Computer Security
    Replies:
    0
    Views:
    608
    code_wrong
    May 15, 2004
  4. Imhotep
    Replies:
    4
    Views:
    568
    Edw. Peach
    Jan 30, 2006
  5. Danny

    Worm\Spybot (P2P-Worm.Win32.SpyBot.a)

    Danny, Aug 14, 2005, in forum: Computer Information
    Replies:
    0
    Views:
    484
    Danny
    Aug 14, 2005
Loading...

Share This Page