Welchia - Should I delete svchost.exe?

[Edna Rose]

Norton detected Welchia.B on my system but failed to
repair or quarrantine. Upon updating virus definitions
and re-scanning, NAV no longer detected the virus..which
I thought was strange. Log still shows previous detection
however. Ran welchia removal tool from sarc and it
detected nothing. SVCHOST.exe in the windows\system32
\drivers directory exists which sarc suggests is a file
associated with the virus.

Should I delete the version in the ...\drivers directory?

Thank you.
Edna Rose

 

[Rick \Nutcase\ Rogers]

Hi,

The only copy of svchost.exe that should be on a system is the one in the
\Windows\system32 folder, ones found in other subdirectories are likely to
be fakes.

--
Best of Luck,

Rick Rogers aka "Nutcase" MS-MVP - Windows
Windows isn't rocket science! That's my other hobby!

Associate Expert - WinXP - Expert Zone

 

[Steve Nielsen]

Norton detected Welchia.B on my system but failed to
repair or quarrantine. Upon updating virus definitions
and re-scanning, NAV no longer detected the virus..which
I thought was strange. Log still shows previous detection
however. Ran welchia removal tool from sarc and it
detected nothing. SVCHOST.exe in the windows\system32
\drivers directory exists which sarc suggests is a file
associated with the virus.

Should I delete the version in the ...\drivers directory?

Thank you.
Edna Rose

Get the removal tool here and read the instructions:

http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

Do NOT delete svchost.exe.

Steve