WORM_NACHI.A + variants

Discussion in 'Computer Support' started by FeaolPlay, Sep 22, 2003.

  1. FeaolPlay

    FeaolPlay Guest

    Anyone using Windows XP + PC-Cillin with latest pattern file and virus
    definitions and seem to have immense uploading when connected to the
    internet please read this:

    http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_NACHI.A

    If you can't download any patches and PC-Cillin probrably won't be able to
    clean, quarantine or delete the file (which usually arrives as DLLHOST.EXE)
    you will have to manually remove it, then download the patch from Microsoft.
    You cannot delete the file whilst in Windows beacause it will be detected as
    currently being used.

    To manually remove it please do the following:

    Restart the PC and press F8 to go into boot menu, select "Safe mode with
    Command Prompt" and press enter.
    Once command prompt is loaded type in:

    > cd\
    > cd/windows/system32/wins
    > del dllhost.exe
    > exit


    Then restart PC by pressing and holding Ctrl+Alt+Del to bring up task
    manager. Click on Shutdown, > Restart.

    When you have logged back onto Windows do another manual scan to make sure
    the worm has not lingered or spread to any other folders. If you do find
    any other folders where the worm has copied itself to, write down the
    folder(s) and repeat the steps above.

    Once there is an all clear from PC-Cillin you can go ahead and download the
    latest patches from Microsoft.


    If for any reason your Windows XP install has become corrupted from the
    removal of the worm (which you shouldn't), then you will have to do a manual
    repair:


    > Restart PC and go into the bios making sure your PC can boot up from the

    CD-ROM drive. Make sure the order of boot-up devices has the CD-ROM drive
    set BEFORE the Hard Drive.
    (If you are running an ASUS motherboard make sure the HDD is disabled from
    the bootlist at first, then make sure you enable it after the first restart
    from the Windows installation)
    > Insert the Windows XP CD-ROM into the drive and reboot.
    > Wait until Windows has copied all the setup files to the HDD and when the

    next menu comes up select on Setup Windows XP not Repair using Recovery
    console.
    > Once next menu comes up, this is where you select repair Windows XP

    installation.
    > From here you can just follow the onscreen instructions.


    After installation is complete and you arrive at the "Welcome User" setup
    screen, ignore everything eg. internet setup Windows activation etc, except
    for account names. Use the same name(s) you used for the first
    installation. All previous internet accounts, Windows desktop settings,
    Programs should be still the same after repairing also do not worry about
    Windows Activation as it should still be activated, just click on remind me
    later.


    FP.
    FeaolPlay, Sep 22, 2003
    #1
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Will

    15454-OC121IR1310 Variants

    Will, Jun 29, 2005, in forum: Cisco
    Replies:
    0
    Views:
    514
  2. Avenger©
    Replies:
    13
    Views:
    594
    Jeff_Relf
    Feb 5, 2005
  3. Avenger©
    Replies:
    13
    Views:
    577
    Jeff_Relf
    Feb 5, 2005
  4. Bob Bob
    Replies:
    17
    Views:
    689
    John Holmes
    Nov 17, 2008
Loading...

Share This Page