W32.Welchia.Worm

[Vito Corleone]

September 27 2003


I am running windows 2000 Server (stand alone) with
Symantect Antivirus 8.0 Corporate Edition. I also did
updated all the patches.

Folks, I have kept getting this message all the time

Scan type: Realtime Protection Scan
Event: Virus Found!
Virus name: W32.Welchia.Worm
File: C:\WINNT\system32\wins\DLLHOST.EXE
Location: C:\WINNT\system32\wins
Computer: SERVER2000
User: SYSTEM
Action taken: Delete failed : Quarantine failed : Access
denied
Date found: Sat Sep 27 21:22:06 2003

I scanned the entire computer and found that DLLHOST.exe
was infected and set the configuration to Delete and no
quarantine if virus found. But the darn Synmantec wont
delete.

Anyone know any remendies? Your advices always usefull
and appreciated.

Thank you.

Vito Corleone
President of Export & Import Oliver Oil
Head of the 5 Families
New York

 

[neo [mvp outlook]]

Have you tried running the removal tool from Symantec?

http://www.sarc.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

/Neo

PS - Don't forget to apply the MS03-039 patch.

 

[Guest]

Perhaps this is worth a try... I've used this technique successfully with other System Files and Folders.

Remove the system drive and put it into another computer as a DATA drive... a non w2k OS would be helpful, unless the drive is NTFS.

Delete the offending system file and replace it with a clean copy...
If deleting doesn't work, then try renaming it... (ie: from DLLHost.exe to DLLHost.ex_ )

Reinstall your system drive into your computer...
(you could also try to do this in DOS... with a boot disk...?)

However, I would make sure you have a REALLY good backup... since I notice that you signed your post as:

Vito Corleone
President of Export & Import Oliver Oil
Head of the 5 Families

.....and I don't want to find any dead fish at my front door... or get my legs broken if it doesn't work! ))

You may contact me directly, if you wish, through www.cgriese.net

----- Vito Corleone wrote: -----

September 27 2003


I am running windows 2000 Server (stand alone) with
Symantect Antivirus 8.0 Corporate Edition. I also did
updated all the patches.

Folks, I have kept getting this message all the time

Scan type: Realtime Protection Scan
Event: Virus Found!
Virus name: W32.Welchia.Worm
File: C:\WINNT\system32\wins\DLLHOST.EXE
Location: C:\WINNT\system32\wins
Computer: SERVER2000
User: SYSTEM
Action taken: Delete failed : Quarantine failed : Access
denied
Date found: Sat Sep 27 21:22:06 2003

I scanned the entire computer and found that DLLHOST.exe
was infected and set the configuration to Delete and no
quarantine if virus found. But the darn Synmantec wont
delete.

Anyone know any remendies? Your advices always usefull
and appreciated.

Thank you.

Vito Corleone
President of Export & Import Oliver Oil
Head of the 5 Families
New York

 

[rex]

I had the same problem. One of the Norton dialogs had a
link to the removal tool on their site. The tool works.

rex

 

[Bruce Chambers]

Greetings --

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Silence Seeker]

I scanned the entire computer and found that DLLHOST.exe
was infected and set the configuration to Delete and no
quarantine if virus found. But the darn Synmantec wont
delete.

Anyone know any remendies? Your advices always usefull
and appreciated.

One more way (does not require Internet access or any other tools):
1. Restart your computer and press F8 at boot, then select "Safe Mode
with Command Line".
2. At the command line type: cd \WINNT\system32\wins
3. Then: del dllhost.exe
4. Exit

That's it.

Sam

 

[David Bowen]

Been there...done this....
Go to the Symantec web site and look
for the Welchia worm definition which
will lead you to a scan/fix download
called "Fixwelch.exe". Run it to remove
the infected files. If you have deleted
the dllhost.dll (5kb in size) from the
\windows\system32 folder then you will
have to replace it as this is not the
infected file

I scanned the entire computer and found that DLLHOST.exe
was infected and set the configuration to Delete and no
quarantine if virus found. But the darn Synmantec wont
delete.

Anyone know any remendies? Your advices always usefull
and appreciated.

One more way (does not require Internet access or any other tools):
1. Restart your computer and press F8 at boot, then select "Safe Mode
with Command Line".
2. At the command line type: cd \WINNT\system32\wins
3. Then: del dllhost.exe
4. Exit

That's it.

Sam

 

[David Bowen]

OOPS...not dllhost.dll but dllhost.exe...sorry!!

Been there...done this....
Go to the Symantec web site and look
for the Welchia worm definition which
will lead you to a scan/fix download
called "Fixwelch.exe". Run it to remove
the infected files. If you have deleted
the dllhost.dll (5kb in size) from the
\windows\system32 folder then you will
have to replace it as this is not the
infected file

I scanned the entire computer and found that DLLHOST.exe
was infected and set the configuration to Delete and no
quarantine if virus found. But the darn Synmantec wont
delete.

Anyone know any remendies? Your advices always usefull
and appreciated.

One more way (does not require Internet access or any other tools):
1. Restart your computer and press F8 at boot, then select "Safe Mode
with Command Line".
2. At the command line type: cd \WINNT\system32\wins
3. Then: del dllhost.exe
4. Exit

That's it.

Sam