W32.Welchia

[Ruster]

I have been plagued with problems from the welchia worm virus on our
network. I ran all the security patches and sevice packs. Then I ran the
removal tool. But I still have one or two computers who still get the damn
virus. I checked virtually every machine and it looks clean. I just have no
idea how this could get in in the first place. We have Norton corporate
edition running on all machines and we have a firewall installed which is
blocking the affected ports.

 

[Clive]

I have been plagued with problems from the welchia worm virus on our
network. I ran all the security patches and sevice packs. Then I ran the
removal tool. But I still have one or two computers who still get the damn
virus. I checked virtually every machine and it looks clean. I just have no
idea how this could get in in the first place. We have Norton corporate
edition running on all machines and we have a firewall installed which is
blocking the affected ports.

Floppy disk? Are any of the machines laptops and do they leave the Network
anytime?

Had a similar problem with a 55 machine LAN/site. Only way I could clean
every machine (without 'chasing the virus') was to disconnect every machine
(i.e. pull the cat5 cable) and run removal tool(s). Then and ONLY then plug
them back in to the LAN

Clive

 

[Ruster]

I suspect the problem is a disk, but the anti-virus would detect the virus.
The symantec is up todate.

 

[Gabriele Neukam]

On that special day, Ruster, ([email protected]) said...

I ran all the security patches and sevice packs. Then I ran the
removal tool. But I still have one or two computers who still get the damn
virus.

On those said machines, un-install the patch and install it again,
without having any program running in the background. There have been
cases when the patch hadn't been installed properly, although the entry
would turn up in Control Panel-Software-Uninstall/Install. Maybe some
Norton or similar install watching program had intercepted the process,
dunno.


Gabriele Neukam

(e-mail address removed)

 

[Guest]

I have been plagued with problems from the welchia worm virus on our
network. I ran all the security patches and sevice packs. Then I ran the
removal tool. But I still have one or two computers who still get the damn
virus. I checked virtually every machine and it looks clean. I just have no
idea how this could get in in the first place. We have Norton corporate
edition running on all machines and we have a firewall installed which is
blocking the affected ports.

how do you run the tool? in Windows? Windows Safe Mode? or DOS environment?
from desktop ?

 

[Ruster]

I suspect the problem was from one of the machines at another office. We
have a WAN with a point to point T1 and some of the operators must have
brought a notebook from the field office with outdated virus defs. I can
only do so much, these people must keep the defs up to date. But do they
listen? NO!!!!

It just makes my job that much more difficult! Not to mention job security.