W32.WELCHIA.WORM

[Hades]

Any ideas how I can get rid of this virus?

I have Norton Anti-Virus on our servers, clients etc. and I have ran the
latest updates and ran the removal tool on all PC's - but when we reboot the
PC's its simply back there?

I think that as I am disinfecting a PC, other PC's may well be infecting it!
I have removed any System Restore capabilities on Windows XP machines - any
other ideas?

Many thanks

 

[FromTheRafters]

Any ideas how I can get rid of this virus?

I have Norton Anti-Virus on our servers, clients etc. and I have ran the
latest updates and ran the removal tool on all PC's - but when we reboot the
PC's its simply back there?

I think that as I am disinfecting a PC, other PC's may well be infecting it!
I have removed any System Restore capabilities on Windows XP machines - any
other ideas?

Patch?

MS03-026

 

[David]

There are two patches which address the means of infection of the welchia
worm.
One which addresses the RPC portmapper vulnerability and another that
addresses a vulnerability in IIS. Simply make sure that your systems are up
to date as far as MS patches are concerned so that you are not exposed to
other known and previously patched vulnerabilities as well.

 

[Hades]

Sorry for the top post - many thanks to both of you I had actually
instructed our department to keep the patches/updates up-to-date and thought
they were - boy, how wrong was I!!!?

 

[David]

It can be real difficult as far as patching when you are dealing with
several staff members, multiple machines and the frequency with which MS is
posting fixes. In such a case you might want to initiate some policy in
which a certain senior dept. member is responsible for running a tool like
MBSA against all the machines you are responsible for on a weekly basis.