Virus Removal Help
14 September 2003, 03:48 PM
#1
Scooby Regular
Thread Starter
Join Date: Jun 2001
Posts: 10,211
Likes: 0
Received 0 Likes
on
0 Posts
My anti-virus software (AVG) has picked up Worm/Nachi, and kindly tells me this every 60 seconds. However when I ask it the remove the virus/move it to the virus vault it tells me it can not be removed.
Does anyone one a way around this?
or
Does anyone know what said virus can do?
Cheers in advance
Does anyone one a way around this?
or
Does anyone know what said virus can do?
Cheers in advance
14 September 2003, 04:02 PM
#2
Scooby Regular
Join Date: Jun 2001
Posts: 219
Likes: 0
Received 0 Likes
on
0 Posts
Also Known As: W32/Welchia.worm10240 [AhnLab], W32/Nachi.worm [McAfee], WORM_MSBLAST.D [Trend], Lovsan.D [F-Secure], W32/Nachi-A [Sophos], Win32.Nachi.A [CA], Worm.Win32.Welchia [KAV]
W32.Welchia.Worm does the following:
Attempts to download the DCOM RPC patch from Microsoft's Windows Update Web site, install it, and then reboot the computer.
Checks for active machines to infect by sending an ICMP echo request, or PING, which will result in increased ICMP traffic.
Attempts to remove W32.Blaster.Worm.
Symantec Security Response has developed a removal tool to clean the infections of W32.Welchia.Worm.
Attempts to download the DCOM RPC patch from Microsoft's Windows Update Web site, install it, and then reboot the computer.
Checks for active machines to infect by sending an ICMP echo request, or PING, which will result in increased ICMP traffic.
Attempts to remove W32.Blaster.Worm.
Symantec Security Response has developed a removal tool to clean the infections of W32.Welchia.Worm.
Removal Tool: http://securityresponse.symantec.com...oval.tool.html
HTH
Bill
14 September 2003, 04:16 PM
#3
Scooby Regular
Join Date: Jul 2001
Posts: 21,865
Likes: 0
Received 0 Likes
on
0 Posts
John,
What version of windows are you using?
NAI Stinger (http://vil.nai.com/vil/stinger/) will remove the worm for you.
The problem that you might be seeing is because of System Restore, so you may need to follow teh steps on this link (http://vil.nai.com/vil/SystemHelpDoc...SysRestore.htm) if you are running Windows ME or XP.
Any problems give me a call!
Ian
What version of windows are you using?
NAI Stinger (http://vil.nai.com/vil/stinger/) will remove the worm for you.
The problem that you might be seeing is because of System Restore, so you may need to follow teh steps on this link (http://vil.nai.com/vil/SystemHelpDoc...SysRestore.htm) if you are running Windows ME or XP.
Any problems give me a call!
Ian
14 September 2003, 05:38 PM
#4
Scooby Regular
Thread Starter
Join Date: Jun 2001
Posts: 10,211
Likes: 0
Received 0 Likes
on
0 Posts
I'm on XP.
Ians deleted the worms secondary file, but not the main one, and the symantec removal couldn't even find the virus. As soon as it had told me that, the AVG pops up to say "Virus Detected"
Stupid thing!
I would call you but I dont have your number Ian.
[Edited by Disco - 9/14/2003 5:40:27 PM]
Ians deleted the worms secondary file, but not the main one, and the symantec removal couldn't even find the virus. As soon as it had told me that, the AVG pops up to say "Virus Detected"
Stupid thing!
I would call you but I dont have your number Ian.
[Edited by Disco - 9/14/2003 5:40:27 PM]
14 September 2003, 07:09 PM
#5
Scooby Regular
Join Date: Aug 2003
Posts: 2,644
Likes: 0
Received 0 Likes
on
0 Posts
There is already a post relating to this exact problem.
http://www.scoobynet.co.uk/bbs/threa...hreadID=242452
(Theres a "search" button at the top of the page!)
http://www.scoobynet.co.uk/bbs/threa...hreadID=242452
(Theres a "search" button at the top of the page!)
Thread
Thread Starter
Forum
Replies
Last Post