Welchia just doesnt go away

[Madhur]

Hello
My Win2k system gets infected with Welchia worm as soon as it
connects to the internet. I have a fully updated Norton
Antivirus, although it detects the virus
but the virus have already been downloaded.

Just after that some sort of error svchost.exe comes up and makes
many things unusable link cut,copy paste.

I dont have any patches installed(SP1-SP4), as my internet
bandwidth is too low to download these patches. Is there any
thing which can be done about this.

--
Winners dont do different things, they do things differently.

Madhur
India
email : madhur<underscore>ahuja<at>yahoo<dot>com

 

[Bruce Chambers]

Greetings --

Essentially, you _need_ to install all of the service packs and
security patches, and you need to install some sort of firewall.
Until you do take such steps to defend yourself, you'll continue being
a willing victim of the "threat of the week."

If you connected the PC to the Internet without having first
installed the KB824146 Hotfix, without having first installed an
antivirus application with current virus definition files, and before
enabling a firewall, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Steve Nielsen]

You will need at least SP2 and the KB823980 patch to prevent re-infection.

Steve