welchia worm

[Thom Campbell]

I am using my WIN98SE machine topost. My wife's XP machine
has acquired the welchia worm, identified by Norton 2002.
She has regularly run updates and virus scans but has the
worm. Machine will boot then lock up after 15 secs. I have
the location of the infected file as
C:\WINDOWS\system 32\TFTP3356 The problem is how to keep
machine in operation long enough to open Windows explorer
and delete infection????

 

[Nicholas]

Thom --

If your computer is constantly attempting to shutdown
or reboot, quickly go to:

Start > Run and type: CMD , and hit enter.
This opens the Command Prompt window.

Then type: shutdown -a , and hit enter.

This should halt the rebooting problem.


--
Nicholas

-------------------------------------------------------------------------------


| I am using my WIN98SE machine topost. My wife's XP machine
| has acquired the welchia worm, identified by Norton 2002.
| She has regularly run updates and virus scans but has the
| worm. Machine will boot then lock up after 15 secs. I have
| the location of the infected file as
| C:\WINDOWS\system 32\TFTP3356 The problem is how to keep
| machine in operation long enough to open Windows explorer
| and delete infection????

 

[Larry Samuels MS-MVP XP \(Shell/User\)]

That is the so-called "good worm" which has several names:
Nachi, and Welchia:

http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html
McAfee Stinger will remove this worm
http://vil.nai.com/vil/stinger/

If you are having trouble staying up to get the patch and removal tool:
When the shutdown prompt appears,go to start/run and type
shutdown -a to abort the shutdown process to allow you to stay up and
online.



--
Larry Samuels MS-MVP (Windows-Shell/User)
Associate Expert
Unofficial FAQ for Windows Server 2003 at
http://home.earthlink.net/~larrysamuels/WS2003FAQ.htm
Expert Zone -