Welcha keeps coming back.

[Eric]

Hi,

The welcha worm seems to keep coming back on my system
and I can't figure out why. Below is what I have done to
clean it up.

1. I've updated my system (WinXP Home) with all the MS
patches.
2. I have norton 2003 installed with all the current dats
3. I have enabled the MS firewall on the dial up service
and I don't use a LAN connection.
4. I've disabled the rollback option.
5. I've run the Symantec welcha cleaning tool. And Cleans
off the 1 instance of the virus.
6. I then have run the Symantec online scan and the
system is reported clean.

At this point I would expect the system to be protected
but later in the day, Norton 2003 pops up with the
infection notification.
If I run the Symantec welcha cleaning tool again, 1
instance of the virus is found.

Does anyone have any ideas? Thanks in advance for your
help.

Eric

 

[JRv]

http://www.help.neu.edu/windowsxpfix.htm

 

[Tom]

I had the same problem. You need to clean the virus
manually.
Follow the instruction on the following link.

http://www.symantec.com/avcenter/venc/data/w32.welchia.worm
..html

good luck,

 

[Eric]

Thanks. I'll give manual removal a try. I did see
TFTP.exe on the system. I know that's a legitimate
program, but can I safely delete it if I don't use it?

 

[Tom R.]

Eric,
If you are still having problems, try the
free online virus scan from RAV.
http://www.ravantivirus.com/
It cleaned it [and 2 others that Norton's
missed] off of mine.
Good Luck,
TR

 

[Tom R.]

Eric,
If you are still having problems, try the
free online virus scan from RAV.
http://www.ravantivirus.com/
It cleaned it [and 2 others that Norton's
missed] off of mine.
Good Luck,
TR

 

[Tom R.]

Eric,
You can also download "The Stinger" from McAFEE
and run it from a floppy. It is a cleaning tool that will
remove most of the latest virus.
http://vil.nai.com/vil/stinger/
Good Luck.

 

[eric]

Thanks all for the help. I finally got it off my
system. The offending file was actually off the system
but stuck in the system restore partition. Thanks again
for the help.

Eric

 

[Peter Hutchison]

Thanks. I'll give manual removal a try. I did see
TFTP.exe on the system. I know that's a legitimate
program, but can I safely delete it if I don't use it?

Yes, you can.

File should be:
23/08/01 13:00 16,896 TFTP.EXE

Peter Hutchison
Windows FAQ
http://www.pcguru.plus.com/