A while back we got the W32.Welchia.Worm on our system
which infected the following. Nortons them removed them.
The tool has deleted the viral file "C:\WINDOWS\system32
\config\systemprofile\Local Settings\Temporary Internet
Files\Content.IE5\S4YWJQ26\WksPatch[1].exe".
The tool has deleted the viral file "C:\WINDOWS\system32
\drivers\svchost.exe".
Since this time, our system likes to reboot itself, and
normally this is when internet explorer is open, but not
in use.
Any suggestions?
Both of the files that were removed were not system files and are not
needed by Windows to run correctly.
When Norton notified you of the welchia worm, you allowed the program to
clean the virus. Did you also visit the Symantec website and look up
welchia in their library? The documentation on the virus has some extra
steps that you need to do manually. Once those are done, any messages
regarding the "missing" (and unwanted) files will be gone.
You still have a problem with Windows rebooting. We need to figure out why.
Suggestions:
--Check that Norton's has kept it's virus definitions up to date. After
confirming that you have current virus definitions, perform a full system
scan. Check the program's help files for directions if you do not know how
to do this.
--Check the system for other malware using products like AdAware from
www.lavasoftusa.com and Spybot Search and Destroy from
http://www.safer-networking.org. Download the programs. Install them.
Update them and then scan the system.
--Check Event Viewer (Start> Run> eventvwr.msc) for error information.
Double click red and yellow items listed in this tool's screens for more
detailed error information. Hopefully, you will be able to pick up on a
pattern (and a few file names) that coincides with the unexpected
shutdowns. With the clues from this tool, research the error messages
online to see if there are known fixes or at least explanations for them.
